fix(server): Address PR #733 review feedback and fix cross-platform tests

- Extract merge logic from pipeline-orchestrator to merge-service.ts to avoid HTTP self-call
- Make agent-executor error handling provider-agnostic using shared isAuthenticationError utility
- Fix cross-platform path handling in tests using path.normalize/path.resolve helpers
- Add catch handlers in plan-approval-service tests to prevent unhandled promise rejection warnings

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.automaker-lock

@@ -1,5 +0,0 @@
-{
-  "pid": 95678,
-  "featureId": "feature-1769860192729-yjxrtx35yh",
-  "startedAt": "2026-03-05T18:26:48.876Z"
-}

.github/actions/setup-project/action.yml

@@ -25,24 +25,17 @@ runs:
         cache: 'npm'
         cache-dependency-path: package-lock.json
 
+    - name: Check for SSH URLs in lockfile
+      if: inputs.check-lockfile == 'true'
+      shell: bash
+      run: npm run lint:lockfile
+
     - name: Configure Git for HTTPS
       shell: bash
       # Convert SSH URLs to HTTPS for git dependencies (e.g., @electron/node-gyp)
       # This is needed because SSH authentication isn't available in CI
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
 
-    - name: Auto-fix SSH URLs in lockfile
-      if: inputs.check-lockfile == 'true'
-      shell: bash
-      # Auto-fix any git+ssh:// URLs in package-lock.json before linting
-      # This handles cases where npm reintroduces SSH URLs for git dependencies
-      run: node scripts/fix-lockfile-urls.mjs
-
-    - name: Check for SSH URLs in lockfile
-      if: inputs.check-lockfile == 'true'
-      shell: bash
-      run: npm run lint:lockfile
-
     - name: Install dependencies
       shell: bash
       # Use npm install instead of npm ci to correctly resolve platform-specific
@@ -52,7 +45,6 @@ runs:
       run: npm install --ignore-scripts --force
 
     - name: Install Linux native bindings
-      if: runner.os == 'Linux'
       shell: bash
       # Workaround for npm optional dependencies bug (npm/cli#4828)
       # Explicitly install Linux bindings needed for build tools

.github/workflows/e2e-tests.yml

@@ -46,8 +46,7 @@ jobs:
           echo "SERVER_PID=$SERVER_PID" >> $GITHUB_ENV
 
         env:
-          PORT: 3108
-          TEST_SERVER_PORT: 3108
+          PORT: 3008
           NODE_ENV: test
           # Use a deterministic API key so Playwright can log in reliably
           AUTOMAKER_API_KEY: test-api-key-for-e2e-tests
@@ -82,13 +81,13 @@ jobs:
 
           # Wait for health endpoint
           for i in {1..60}; do
-            if curl -s -f http://localhost:3108/api/health > /dev/null 2>&1; then
+            if curl -s -f http://localhost:3008/api/health > /dev/null 2>&1; then
               echo "Backend server is ready!"
               echo "=== Backend logs ==="
               cat backend.log
               echo ""
               echo "Health check response:"
-              curl -s http://localhost:3108/api/health | jq . 2>/dev/null || echo "Health check: $(curl -s http://localhost:3108/api/health 2>/dev/null || echo 'No response')"
+              curl -s http://localhost:3008/api/health | jq . 2>/dev/null || echo "Health check: $(curl -s http://localhost:3008/api/health 2>/dev/null || echo 'No response')"
               exit 0
             fi
             
@@ -112,11 +111,11 @@ jobs:
           ps aux | grep -E "(node|tsx)" | grep -v grep || echo "No node processes found"
           echo ""
           echo "=== Port status ==="
-          netstat -tlnp 2>/dev/null | grep :3108 || echo "Port 3108 not listening"
-          lsof -i :3108 2>/dev/null || echo "lsof not available or port not in use"
+          netstat -tlnp 2>/dev/null | grep :3008 || echo "Port 3008 not listening"
+          lsof -i :3008 2>/dev/null || echo "lsof not available or port not in use"
           echo ""
           echo "=== Health endpoint test ==="
-          curl -v http://localhost:3108/api/health 2>&1 || echo "Health endpoint failed"
+          curl -v http://localhost:3008/api/health 2>&1 || echo "Health endpoint failed"
 
           # Kill the server process if it's still hanging
           if kill -0 $SERVER_PID 2>/dev/null; then
@@ -133,8 +132,7 @@ jobs:
         run: npm run test --workspace=apps/ui
         env:
           CI: true
-          VITE_SERVER_URL: http://localhost:3108
-          SERVER_URL: http://localhost:3108
+          VITE_SERVER_URL: http://localhost:3008
           VITE_SKIP_SETUP: 'true'
           # Keep UI-side login/defaults consistent
           AUTOMAKER_API_KEY: test-api-key-for-e2e-tests
@@ -149,7 +147,7 @@ jobs:
           ps aux | grep -E "(node|tsx)" | grep -v grep || echo "No node processes found"
           echo ""
           echo "=== Port status ==="
-          netstat -tlnp 2>/dev/null | grep :3108 || echo "Port 3108 not listening"
+          netstat -tlnp 2>/dev/null | grep :3008 || echo "Port 3008 not listening"
 
       - name: Upload Playwright report
         uses: actions/upload-artifact@v4

.github/workflows/release.yml

@@ -95,11 +95,9 @@ jobs:
   upload:
     needs: build
     runs-on: ubuntu-latest
+    if: github.event.release.draft == false
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
       - name: Download macOS artifacts
         uses: actions/download-artifact@v4
         with:

.gitignore

@@ -90,8 +90,6 @@ pnpm-lock.yaml
 yarn.lock
 
 # Fork-specific workflow files (should never be committed)
-DEVELOPMENT_WORKFLOW.md
-check-sync.sh
 # API key files
 data/.api-key
 data/credentials.json
@@ -100,5 +98,3 @@ data/
 
 # GSD planning docs (local-only)
 .planning/
-.mcp.json
-.planning

.husky/pre-commit

@@ -38,18 +38,6 @@ else
   export PATH="$PATH:/usr/local/bin:/opt/homebrew/bin:/usr/bin"
 fi
 
-# Auto-fix git+ssh:// URLs in package-lock.json if it's being committed
-# This prevents CI failures from SSH URLs that npm introduces for git dependencies
-if git diff --cached --name-only | grep -q "^package-lock.json$"; then
-  if command -v node >/dev/null 2>&1; then
-    if grep -q "git+ssh://" package-lock.json 2>/dev/null; then
-      echo "Fixing git+ssh:// URLs in package-lock.json..."
-      node scripts/fix-lockfile-urls.mjs
-      git add package-lock.json
-    fi
-  fi
-fi
-
 # Run lint-staged - works with or without nvm
 # Prefer npx, fallback to npm exec, both work with system-installed Node.js
 if command -v npx >/dev/null 2>&1; then

CLAUDE.md

@@ -161,7 +161,7 @@ Use `resolveModelString()` from `@automaker/model-resolver` to convert model ali
 
 - `haiku` → `claude-haiku-4-5`
 - `sonnet` → `claude-sonnet-4-20250514`
-- `opus` → `claude-opus-4-6`
+- `opus` → `claude-opus-4-5-20251101`
 
 ## Environment Variables
 

DEVELOPMENT_WORKFLOW.md

@@ -0,0 +1,253 @@
+# Development Workflow
+
+This document defines the standard workflow for keeping a branch in sync with the upstream
+release candidate (RC) and for shipping feature work. It is paired with `check-sync.sh`.
+
+## Quick Decision Rule
+
+1. Ask the user to select a workflow:
+   - **Sync Workflow** → you are maintaining the current RC branch with fixes/improvements
+     and will push the same fixes to both origin and upstream RC when you have local
+     commits to publish.
+   - **PR Workflow** → you are starting new feature work on a new branch; upstream updates
+     happen via PR only.
+2. After the user selects, run:
+   ```bash
+   ./check-sync.sh
+   ```
+3. Use the status output to confirm alignment. If it reports **diverged**, default to
+   merging `upstream/<TARGET_RC>` into the current branch and preserving local commits.
+   For Sync Workflow, when the working tree is clean and you are behind upstream RC,
+   proceed with the fetch + merge without asking for additional confirmation.
+
+## Target RC Resolution
+
+The target RC is resolved dynamically so the workflow stays current as the RC changes.
+
+Resolution order:
+
+1. Latest `upstream/v*rc` branch (auto-detected)
+2. `upstream/HEAD` (fallback)
+3. If neither is available, you must pass `--rc <branch>`
+
+Override for a single run:
+
+```bash
+./check-sync.sh --rc <rc-branch>
+```
+
+## Pre-Flight Checklist
+
+1. Confirm a clean working tree:
+   ```bash
+   git status
+   ```
+2. Confirm the current branch:
+   ```bash
+   git branch --show-current
+   ```
+3. Ensure remotes exist (origin + upstream):
+   ```bash
+   git remote -v
+   ```
+
+## Sync Workflow (Upstream Sync)
+
+Use this flow when you are updating the current branch with fixes or improvements and
+intend to keep origin and upstream RC in lockstep.
+
+1. **Check sync status**
+   ```bash
+   ./check-sync.sh
+   ```
+2. **Update from upstream RC before editing (no pulls)**
+   - **Behind upstream RC** → fetch and merge RC into your branch:
+     ```bash
+     git fetch upstream
+     git merge upstream/<TARGET_RC> --no-edit
+     ```
+     When the working tree is clean and the user selected Sync Workflow, proceed without
+     an extra confirmation prompt.
+   - **Diverged** → stop and resolve manually.
+3. **Resolve conflicts if needed**
+   - Handle conflicts intelligently: preserve upstream behavior and your local intent.
+4. **Make changes and commit (if you are delivering fixes)**
+   ```bash
+   git add -A
+   git commit -m "type: description"
+   ```
+5. **Build to verify**
+   ```bash
+   npm run build:packages
+   npm run build
+   ```
+6. **Push after a successful merge to keep remotes aligned**
+   - If you only merged upstream RC changes, push **origin only** to sync your fork:
+     ```bash
+     git push origin <branch>
+     ```
+   - If you have local fixes to publish, push **origin + upstream**:
+     ```bash
+     git push origin <branch>
+     git push upstream <branch>:<TARGET_RC>
+     ```
+   - Always ask the user which push to perform.
+   - Origin (origin-only sync):
+     ```bash
+     git push origin <branch>
+     ```
+   - Upstream RC (publish the same fixes when you have local commits):
+     ```bash
+     git push upstream <branch>:<TARGET_RC>
+     ```
+7. **Re-check sync**
+   ```bash
+   ./check-sync.sh
+   ```
+
+## PR Workflow (Feature Work)
+
+Use this flow only for new feature work on a new branch. Do not push to upstream RC.
+
+1. **Create or switch to a feature branch**
+   ```bash
+   git checkout -b <branch>
+   ```
+2. **Make changes and commit**
+   ```bash
+   git add -A
+   git commit -m "type: description"
+   ```
+3. **Merge upstream RC before shipping**
+   ```bash
+   git merge upstream/<TARGET_RC> --no-edit
+   ```
+4. **Build and/or test**
+   ```bash
+   npm run build:packages
+   npm run build
+   ```
+5. **Push to origin**
+   ```bash
+   git push -u origin <branch>
+   ```
+6. **Create or update the PR**
+   - Use `gh pr create` or the GitHub UI.
+7. **Review and follow-up**
+
+- Apply feedback, commit changes, and push again.
+- Re-run `./check-sync.sh` if additional upstream sync is needed.
+
+## Conflict Resolution Checklist
+
+1. Identify which changes are from upstream vs. local.
+2. Preserve both behaviors where possible; avoid dropping either side.
+3. Prefer minimal, safe integrations over refactors.
+4. Re-run build commands after resolving conflicts.
+5. Re-run `./check-sync.sh` to confirm status.
+
+## Build/Test Matrix
+
+- **Sync Workflow**: `npm run build:packages` and `npm run build`.
+- **PR Workflow**: `npm run build:packages` and `npm run build` (plus relevant tests).
+
+## Post-Sync Verification
+
+1. `git status` should be clean.
+2. `./check-sync.sh` should show expected alignment.
+3. Verify recent commits with:
+   ```bash
+   git log --oneline -5
+   ```
+
+## check-sync.sh Usage
+
+- Uses dynamic Target RC resolution (see above).
+- Override target RC:
+  ```bash
+  ./check-sync.sh --rc <rc-branch>
+  ```
+- Optional preview limit:
+  ```bash
+  ./check-sync.sh --preview 10
+  ```
+- The script prints sync status for both origin and upstream and previews recent commits
+  when you are behind.
+
+## Stop Conditions
+
+Stop and ask for guidance if any of the following are true:
+
+- The working tree is dirty and you are about to merge or push.
+- `./check-sync.sh` reports **diverged** during PR Workflow, or a merge cannot be completed.
+- The script cannot resolve a target RC and requests `--rc`.
+- A build fails after sync or conflict resolution.
+
+## AI Agent Guardrails
+
+- Always run `./check-sync.sh` before merges or pushes.
+- Always ask for explicit user approval before any push command.
+- Do not ask for additional confirmation before a Sync Workflow fetch + merge when the
+  working tree is clean and the user has already selected the Sync Workflow.
+- Choose Sync vs PR workflow based on intent (RC maintenance vs new feature work), not
+  on the script's workflow hint.
+- Only use force push when the user explicitly requests a history rewrite.
+- Ask for explicit approval before dependency installs, branch deletion, or destructive operations.
+- When resolving merge conflicts, preserve both upstream changes and local intent where possible.
+- Do not create or switch to new branches unless the user explicitly requests it.
+
+## AI Agent Decision Guidance
+
+Agents should provide concrete, task-specific suggestions instead of repeatedly asking
+open-ended questions. Use the user's stated goal and the `./check-sync.sh` status to
+propose a default path plus one or two alternatives, and only ask for confirmation when
+an action requires explicit approval.
+
+Default behavior:
+
+- If the intent is RC maintenance, recommend the Sync Workflow and proceed with
+  safe preparation steps (status checks, previews). If the branch is behind upstream RC,
+  fetch and merge without additional confirmation when the working tree is clean, then
+  push to origin to keep the fork aligned. Push upstream only when there are local fixes
+  to publish.
+- If the intent is new feature work, recommend the PR Workflow and proceed with safe
+  preparation steps (status checks, identifying scope). Ask for approval before merges,
+  pushes, or dependency installs.
+- If `./check-sync.sh` reports **diverged** during Sync Workflow, merge
+  `upstream/<TARGET_RC>` into the current branch and preserve local commits.
+- If `./check-sync.sh` reports **diverged** during PR Workflow, stop and ask for guidance
+  with a short explanation of the divergence and the minimal options to resolve it.
+  If the user's intent is RC maintenance, prefer the Sync Workflow regardless of the
+  script hint. When the intent is new feature work, use the PR Workflow and avoid upstream
+  RC pushes.
+
+Suggestion format (keep it short):
+
+- **Recommended**: one sentence with the default path and why it fits the task.
+- **Alternatives**: one or two options with the tradeoff or prerequisite.
+- **Approval points**: mention any upcoming actions that need explicit approval (exclude sync
+  workflow pushes and merges).
+
+## Failure Modes and How to Avoid Them
+
+Sync Workflow:
+
+- Wrong RC target: verify the auto-detected RC in `./check-sync.sh` output before merging.
+- Diverged from upstream RC: stop and resolve manually before any merge or push.
+- Dirty working tree: commit or stash before syncing to avoid accidental merges.
+- Missing remotes: ensure both `origin` and `upstream` are configured before syncing.
+- Build breaks after sync: run `npm run build:packages` and `npm run build` before pushing.
+
+PR Workflow:
+
+- Branch not synced to current RC: re-run `./check-sync.sh` and merge RC before shipping.
+- Pushing the wrong branch: confirm `git branch --show-current` before pushing.
+- Unreviewed changes: always commit and push to origin before opening or updating a PR.
+- Skipped tests/builds: run the build commands before declaring the PR ready.
+
+## Notes
+
+- Avoid merging with uncommitted changes; commit or stash first.
+- Prefer merge over rebase for PR branches; rebases rewrite history and often require a force push,
+  which should only be done with an explicit user request.
+- Use clear, conventional commit messages and split unrelated changes into separate commits.

Dockerfile

@@ -118,7 +118,6 @@ RUN curl -fsSL https://opencode.ai/install | bash && \
     echo "=== Checking OpenCode CLI installation ===" && \
     ls -la /home/automaker/.local/bin/ && \
     (which opencode && opencode --version) || echo "opencode installed (may need auth setup)"
-
 USER root
 
 # Add PATH to profile so it's available in all interactive shells (for login shells)
@@ -148,15 +147,6 @@ COPY --from=server-builder /app/apps/server/package*.json ./apps/server/
 # Copy node_modules (includes symlinks to libs)
 COPY --from=server-builder /app/node_modules ./node_modules
 
-# Install Playwright Chromium browser for AI agent verification tests
-# This adds ~300MB to the image but enables automated testing mode out of the box
-# Using the locally installed playwright ensures we use the pinned version from package-lock.json
-USER automaker
-RUN ./node_modules/.bin/playwright install chromium && \
-    echo "=== Playwright Chromium installed ===" && \
-    ls -la /home/automaker/.cache/ms-playwright/
-USER root
-
 # Create data and projects directories
 RUN mkdir -p /data /projects && chown automaker:automaker /data /projects
 
@@ -209,10 +199,9 @@ COPY libs ./libs
 COPY apps/ui ./apps/ui
 
 # Build packages in dependency order, then build UI
-# When VITE_SERVER_URL is empty, the UI uses relative URLs (e.g., /api/...) which nginx proxies
-# to the server container. This avoids CORS issues entirely in Docker Compose setups.
-# Override at build time if needed: --build-arg VITE_SERVER_URL=http://api.example.com
-ARG VITE_SERVER_URL=
+# VITE_SERVER_URL tells the UI where to find the API server
+# Use ARG to allow overriding at build time: --build-arg VITE_SERVER_URL=http://api.example.com
+ARG VITE_SERVER_URL=http://localhost:3008
 ENV VITE_SKIP_ELECTRON=true
 ENV VITE_SERVER_URL=${VITE_SERVER_URL}
 RUN npm run build:packages && npm run build --workspace=apps/ui

LICENSE

@@ -1,27 +1,141 @@
-## Project Status
+AUTOMAKER LICENSE AGREEMENT
 
-**This project is no longer actively maintained.** The codebase is provided as-is for those who wish to use, study, or fork it. No bug fixes, security updates, or new features are being developed. Community contributions may still be accepted, but there is no guarantee of review or merge.
+This License Agreement ("Agreement") is entered into between you ("Licensee") and the copyright holders of Automaker ("Licensor"). By using, copying, modifying, downloading, cloning, or distributing the Software (as defined below), you agree to be bound by the terms of this Agreement.
+
+1. DEFINITIONS
+
+"Software" means the Automaker software, including all source code, object code, documentation, and related materials.
+
+"Generated Files" means files created by the Software during normal operation to store internal state, configuration, or working data, including but not limited to app_spec.txt, feature.json, and similar files generated by the Software. Generated Files are not considered part of the Software for the purposes of this license and are not subject to the restrictions herein.
+
+"Derivative Work" means any work that is based on, derived from, or incorporates the Software or any substantial portion of it, including but not limited to modifications, forks, adaptations, translations, or any altered version of the Software.
+
+"Monetization" means any activity that generates revenue, income, or commercial benefit from the Software itself or any Derivative Work, including but not limited to:
+
+- Reselling, redistributing, or sublicensing the Software, any Derivative Work, or any substantial portion thereof
+- Including the Software, any Derivative Work, or substantial portions thereof in a product or service that you sell or distribute
+- Offering the Software, any Derivative Work, or substantial portions thereof as a standalone product or service for sale
+- Hosting the Software or any Derivative Work as a service (whether free or paid) for use by others, including cloud hosting, Software-as-a-Service (SaaS), or any other form of hosted access for third parties
+- Extracting, reselling, redistributing, or sublicensing any prompts, context, or other instructional content bundled within the Software
+- Creating, distributing, or selling modified versions, forks, or Derivative Works of the Software
+
+Monetization does NOT include:
+
+- Using the Software internally within your organization, regardless of whether your organization is for-profit
+- Using the Software to build products or services that generate revenue, as long as you are not reselling or redistributing the Software itself
+- Using the Software to provide services for which fees are charged, as long as the Software itself is not being resold or redistributed
+- Hosting the Software anywhere for personal use by a single developer, as long as the Software is not made accessible to others
+
+"Core Contributors" means the following individuals who are granted perpetual, royalty-free licenses:
+
+- Cody Seibert (webdevcody)
+- SuperComboGamer (SCG)
+- Kacper Lachowicz (Shironex, Shirone)
+- Ben Scott (trueheads)
+
+2. GRANT OF LICENSE
+
+Subject to the terms and conditions of this Agreement, Licensor hereby grants to Licensee a non-exclusive, non-transferable license to use, copy, modify, and distribute the Software, provided that:
+
+a) Licensee may freely clone, install, and use the Software locally or within an organization for the purpose of building, developing, and maintaining other products, software, or services. There are no restrictions on the products you build _using_ the Software.
+
+b) Licensee may run the Software on personal or organizational infrastructure for internal use.
+
+c) Core Contributors are each individually granted a perpetual, worldwide, royalty-free, non-exclusive license to use, copy, modify, distribute, and sublicense the Software for any purpose, including Monetization, without payment of any fees or royalties. Each Core Contributor may exercise these rights independently and does not require permission, consent, or approval from any other Core Contributor to Monetize the Software in any way they see fit.
+
+d) Commercial licenses for the Software may be discussed and issued to external parties or companies seeking to use the Software for financial gain or Monetization purposes. Core Contributors already have full rights under section 2(c) and do not require commercial licenses. Any commercial license issued to external parties shall require a unanimous vote by all Core Contributors and shall be granted in writing and signed by all Core Contributors.
+
+e) The list of individuals defined as "Core Contributors" in Section 1 shall be amended to reflect any revocation or reinstatement of status made under this section.
+
+3. RESTRICTIONS
+
+Licensee may NOT:
+
+- Engage in any Monetization of the Software or any Derivative Work without explicit written permission from all Core Contributors
+- Resell, redistribute, or sublicense the Software, any Derivative Work, or any substantial portion thereof
+- Create, distribute, or sell modified versions, forks, or Derivative Works of the Software for any commercial purpose
+- Include the Software, any Derivative Work, or substantial portions thereof in a product or service that you sell or distribute
+- Offer the Software, any Derivative Work, or substantial portions thereof as a standalone product or service for sale
+- Extract, resell, redistribute, or sublicense any prompts, context, or other instructional content bundled within the Software
+- Host the Software or any Derivative Work as a service (whether free or paid) for use by others (except Core Contributors)
+- Remove or alter any copyright notices or license terms
+- Use the Software in any manner that violates applicable laws or regulations
+
+Licensee MAY:
+
+- Use the Software internally within their organization (commercial or non-profit)
+- Use the Software to build other commercial products (products that do NOT contain the Software or Derivative Works)
+- Modify the Software for internal use within their organization (commercial or non-profit)
+
+4. CORE CONTRIBUTOR STATUS MANAGEMENT
+
+a) Core Contributor status may be revoked indefinitely by the remaining Core Contributors if:
+
+- A Core Contributor cannot be reached for a period of one (1) month through reasonable means of communication (including but not limited to email, Discord, GitHub, or other project communication channels)
+- AND the Core Contributor has not contributed to the project during that one-month period. For purposes of this section, "contributed" means at least one of the following activities:
+  - Discussing the Software through project communication channels
+  - Committing code changes to the project repository
+  - Submitting bug fixes or patches
+  - Participating in project-related discussions or decision-making
+
+b) Revocation of Core Contributor status requires a unanimous vote by all other Core Contributors (excluding the Core Contributor whose status is being considered for revocation).
+
+c) Upon revocation of Core Contributor status, the individual shall no longer be considered a Core Contributor and shall lose the rights granted under section 2(c) of this Agreement. However, any Contributions made prior to revocation shall remain subject to the terms of section 5 (CONTRIBUTIONS AND RIGHTS ASSIGNMENT).
+
+d) A revoked Core Contributor may be reinstated to Core Contributor status with a unanimous vote by all current Core Contributors. Upon reinstatement, the individual shall regain all rights granted under section 2(c) of this Agreement.
+
+5. CONTRIBUTIONS AND RIGHTS ASSIGNMENT
+
+By submitting, pushing, or contributing any code, documentation, pull requests, issues, or other materials ("Contributions") to the Automaker project, you agree to the following terms without reservation:
+
+a) **Full Ownership Transfer & Rights Grant:** You hereby assign to the Core Contributors all right, title, and interest in and to your Contributions, including all copyrights, patents, and other intellectual property rights. If such assignment is not effective under applicable law, you grant the Core Contributors an unrestricted, perpetual, worldwide, non-exclusive, royalty-free, fully paid-up, irrevocable, sublicensable, and transferable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform, display, and otherwise exploit your Contributions in any manner they see fit, including for any commercial purpose or Monetization.
+
+b) **No Take-Backs:** You understand and agree that this grant of rights is irrevocable ("no take-backs"). You cannot revoke, rescind, or terminate this grant of rights once your Contribution has been submitted.
+
+c) **Waiver of Moral Rights:** You waive any "moral rights" or other rights with respect to attribution of authorship or integrity of materials regarding your Contributions that you may have under any applicable law.
+
+d) **Right to Contribute:** You represent and warrant that you are the original author of the Contributions, or that you have sufficient rights to grant the rights conveyed by this section, and that your Contributions do not infringe upon the rights of any third party.
+
+6. TERMINATION
+
+This license will terminate automatically if Licensee breaches any term of this Agreement. Upon termination, Licensee must immediately cease all use of the Software and destroy all copies in their possession.
+
+7. HIGH RISK DISCLAIMER AND LIMITATION OF LIABILITY
+
+a) **AI RISKS:** THE SOFTWARE UTILIZES ARTIFICIAL INTELLIGENCE TO GENERATE CODE, EXECUTE COMMANDS, AND INTERACT WITH YOUR FILE SYSTEM. YOU ACKNOWLEDGE THAT AI SYSTEMS CAN BE UNPREDICTABLE, MAY GENERATE INCORRECT, INSECURE, OR DESTRUCTIVE CODE, AND MAY TAKE ACTIONS THAT COULD DAMAGE YOUR SYSTEM, FILES, OR HARDWARE.
+
+b) **USE AT YOUR OWN RISK:** YOU AGREE THAT YOUR USE OF THE SOFTWARE IS SOLELY AT YOUR OWN RISK. THE CORE CONTRIBUTORS AND LICENSOR DO NOT GUARANTEE THAT THE SOFTWARE OR ANY CODE GENERATED BY IT WILL BE SAFE, BUG-FREE, OR FUNCTIONAL.
+
+c) **NO WARRANTY:** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+d) **LIMITATION OF LIABILITY:** IN NO EVENT SHALL THE CORE CONTRIBUTORS, LICENSORS, OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE, INCLUDING BUT NOT LIMITED TO:
+
+- DAMAGE TO HARDWARE OR COMPUTER SYSTEMS
+- DATA LOSS OR CORRUPTION
+- GENERATION OF BAD, VULNERABLE, OR MALICIOUS CODE
+- FINANCIAL LOSSES
+- BUSINESS INTERRUPTION
+
+8. LICENSE AMENDMENTS
+
+Any amendment, modification, or update to this License Agreement must be agreed upon unanimously by all Core Contributors. No changes to this Agreement shall be effective unless all Core Contributors have provided their written consent or approval through a unanimous vote.
+
+9. CONTACT
+
+For inquiries regarding this license or permissions for Monetization, please contact the Core Contributors through the official project channels:
+
+- Agentic Jumpstart Discord: https://discord.gg/JUDWZDN3VT
+- Website: https://automaker.app
+- Email: automakerapp@gmail.com
+
+Any permission for Monetization requires the unanimous written consent of all Core Contributors.
+
+10. GOVERNING LAW
+
+This Agreement shall be governed by and construed in accordance with the laws of the State of Tennessee, USA, without regard to conflict of law principles.
+
+By using the Software, you acknowledge that you have read this Agreement, understand it, and agree to be bound by its terms and conditions.
 
 ---
 
-MIT License
-
 Copyright (c) 2025 Automaker Core Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

OPENCODE_CONFIG_CONTENT

@@ -1,2 +0,0 @@
-{
-  "$schema": "https://opencode.ai/config.json",}

README.md

@@ -288,31 +288,6 @@ services:
 
 **Note:** The Claude CLI config must be writable (do not use `:ro` flag) as the CLI writes debug files.
 
-> **⚠️ Important: Linux/WSL Users**
->
-> The container runs as UID 1001 by default. If your host user has a different UID (common on Linux/WSL where the first user is UID 1000), you must create a `.env` file to match your host user:
->
-> ```bash
-> # Check your UID/GID
-> id -u  # outputs your UID (e.g., 1000)
-> id -g  # outputs your GID (e.g., 1000)
-> ```
->
-> Create a `.env` file in the automaker directory:
->
-> ```
-> UID=1000
-> GID=1000
-> ```
->
-> Then rebuild the images:
->
-> ```bash
-> docker compose build
-> ```
->
-> Without this, files written by the container will be inaccessible to your host user.
-
 ##### GitHub CLI Authentication (For Git Push/PR Operations)
 
 To enable git push and GitHub CLI operations inside the container:
@@ -363,42 +338,6 @@ services:
 
 The Docker image supports both AMD64 and ARM64 architectures. The GitHub CLI and Claude CLI are automatically downloaded for the correct architecture during build.
 
-##### Playwright for Automated Testing
-
-The Docker image includes **Playwright Chromium pre-installed** for AI agent verification tests. When agents implement features in automated testing mode, they use Playwright to verify the implementation works correctly.
-
-**No additional setup required** - Playwright verification works out of the box.
-
-#### Optional: Persist browsers for manual updates
-
-By default, Playwright Chromium is pre-installed in the Docker image. If you need to manually update browsers or want to persist browser installations across container restarts (not image rebuilds), you can mount a volume.
-
-**Important:** When you first add this volume mount to an existing setup, the empty volume will override the pre-installed browsers. You must re-install them:
-
-```bash
-# After adding the volume mount for the first time
-docker exec --user automaker -w /app automaker-server npx playwright install chromium
-```
-
-Add this to your `docker-compose.override.yml`:
-
-```yaml
-services:
-  server:
-    volumes:
-      - playwright-cache:/home/automaker/.cache/ms-playwright
-
-volumes:
-  playwright-cache:
-    name: automaker-playwright-cache
-```
-
-**Updating browsers manually:**
-
-```bash
-docker exec --user automaker -w /app automaker-server npx playwright install chromium
-```
-
 ### Testing
 
 #### End-to-End Tests (Playwright)
@@ -705,10 +644,26 @@ Join the **Agentic Jumpstart** Discord to connect with other builders exploring
 
 👉 [Agentic Jumpstart Discord](https://discord.gg/jjem7aEDKU)
 
-## Project Status
-
-**This project is no longer actively maintained.** The codebase is provided as-is for those who wish to use, study, or fork it. No bug fixes, security updates, or new features are being developed. Community contributions may still be accepted, but there is no guarantee of review or merge.
-
 ## License
 
-This project is licensed under the **MIT License**. See [LICENSE](LICENSE) for the full text.
+This project is licensed under the **Automaker License Agreement**. See [LICENSE](LICENSE) for the full text.
+
+**Summary of Terms:**
+
+- **Allowed:**
+  - **Build Anything:** You can clone and use Automaker locally or in your organization to build ANY product (commercial or free).
+  - **Internal Use:** You can use it internally within your company (commercial or non-profit) without restriction.
+  - **Modify:** You can modify the code for internal use within your organization (commercial or non-profit).
+
+- **Restricted (The "No Monetization of the Tool" Rule):**
+  - **No Resale:** You cannot resell Automaker itself.
+  - **No SaaS:** You cannot host Automaker as a service for others.
+  - **No Monetizing Mods:** You cannot distribute modified versions of Automaker for money.
+
+- **Liability:**
+  - **Use at Own Risk:** This tool uses AI. We are **NOT** responsible if it breaks your computer, deletes your files, or generates bad code. You assume all risk.
+
+- **Contributing:**
+  - By contributing to this repository, you grant the Core Contributors full, irrevocable rights to your code (copyright assignment).
+
+**Core Contributors** (Cody Seibert (webdevcody), SuperComboGamer (SCG), Kacper Lachowicz (Shironex, Shirone), and Ben Scott (trueheads)) are granted perpetual, royalty-free licenses for any use, including monetization.

apps/server/.env.example

@@ -52,12 +52,6 @@ HOST=0.0.0.0
 # Port to run the server on
 PORT=3008
 
-# Port to run the server on for testing
-TEST_SERVER_PORT=3108
-
-# Port to run the UI on for testing
-TEST_PORT=3107
-
 # Data directory for sessions and metadata
 DATA_DIR=./data
 

apps/server/eslint.config.mjs

@@ -1,74 +0,0 @@
-import { defineConfig, globalIgnores } from 'eslint/config';
-import js from '@eslint/js';
-import ts from '@typescript-eslint/eslint-plugin';
-import tsParser from '@typescript-eslint/parser';
-
-const eslintConfig = defineConfig([
-  js.configs.recommended,
-  {
-    files: ['**/*.ts'],
-    languageOptions: {
-      parser: tsParser,
-      parserOptions: {
-        ecmaVersion: 'latest',
-        sourceType: 'module',
-      },
-      globals: {
-        // Node.js globals
-        console: 'readonly',
-        process: 'readonly',
-        Buffer: 'readonly',
-        __dirname: 'readonly',
-        __filename: 'readonly',
-        URL: 'readonly',
-        URLSearchParams: 'readonly',
-        AbortController: 'readonly',
-        AbortSignal: 'readonly',
-        fetch: 'readonly',
-        Response: 'readonly',
-        Request: 'readonly',
-        Headers: 'readonly',
-        FormData: 'readonly',
-        RequestInit: 'readonly',
-        // Timers
-        setTimeout: 'readonly',
-        setInterval: 'readonly',
-        clearTimeout: 'readonly',
-        clearInterval: 'readonly',
-        setImmediate: 'readonly',
-        clearImmediate: 'readonly',
-        queueMicrotask: 'readonly',
-        // Node.js types
-        NodeJS: 'readonly',
-      },
-    },
-    plugins: {
-      '@typescript-eslint': ts,
-    },
-    rules: {
-      ...ts.configs.recommended.rules,
-      '@typescript-eslint/no-unused-vars': [
-        'warn',
-        {
-          argsIgnorePattern: '^_',
-          varsIgnorePattern: '^_',
-          caughtErrorsIgnorePattern: '^_',
-          ignoreRestSiblings: true,
-        },
-      ],
-      '@typescript-eslint/no-explicit-any': 'warn',
-      // Server code frequently works with terminal output containing ANSI escape codes
-      'no-control-regex': 'off',
-      '@typescript-eslint/ban-ts-comment': [
-        'error',
-        {
-          'ts-nocheck': 'allow-with-description',
-          minimumDescriptionLength: 10,
-        },
-      ],
-    },
-  },
-  globalIgnores(['dist/**', 'node_modules/**']),
-]);
-
-export default eslintConfig;

apps/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automaker/server",
-  "version": "0.15.0",
+  "version": "0.13.0",
   "description": "Backend server for Automaker - provides API for both web and Electron modes",
   "author": "AutoMaker Team",
   "license": "SEE LICENSE IN LICENSE",
@@ -24,7 +24,7 @@
     "test:unit": "vitest run tests/unit"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.2.32",
+    "@anthropic-ai/claude-agent-sdk": "0.1.76",
     "@automaker/dependency-resolver": "1.0.0",
     "@automaker/git-utils": "1.0.0",
     "@automaker/model-resolver": "1.0.0",
@@ -34,7 +34,7 @@
     "@automaker/utils": "1.0.0",
     "@github/copilot-sdk": "^0.1.16",
     "@modelcontextprotocol/sdk": "1.25.2",
-    "@openai/codex-sdk": "^0.98.0",
+    "@openai/codex-sdk": "^0.77.0",
     "cookie-parser": "1.4.7",
     "cors": "2.8.5",
     "dotenv": "17.2.3",
@@ -45,7 +45,6 @@
     "yaml": "2.7.0"
   },
   "devDependencies": {
-    "@playwright/test": "1.57.0",
     "@types/cookie": "0.6.0",
     "@types/cookie-parser": "1.4.10",
     "@types/cors": "2.8.19",

apps/server/src/index.ts

@@ -66,10 +66,6 @@ import { createCodexRoutes } from './routes/codex/index.js';
 import { CodexUsageService } from './services/codex-usage-service.js';
 import { CodexAppServerService } from './services/codex-app-server-service.js';
 import { CodexModelCacheService } from './services/codex-model-cache-service.js';
-import { createZaiRoutes } from './routes/zai/index.js';
-import { ZaiUsageService } from './services/zai-usage-service.js';
-import { createGeminiRoutes } from './routes/gemini/index.js';
-import { GeminiUsageService } from './services/gemini-usage-service.js';
 import { createGitHubRoutes } from './routes/github/index.js';
 import { createContextRoutes } from './routes/context/index.js';
 import { createBacklogPlanRoutes } from './routes/backlog-plan/index.js';
@@ -125,57 +121,21 @@ const BOX_CONTENT_WIDTH = 67;
 // The Claude Agent SDK can use either ANTHROPIC_API_KEY or Claude Code CLI authentication
 (async () => {
   const hasAnthropicKey = !!process.env.ANTHROPIC_API_KEY;
-  const hasEnvOAuthToken = !!process.env.CLAUDE_CODE_OAUTH_TOKEN;
-
-  logger.debug('[CREDENTIAL_CHECK] Starting credential detection...');
-  logger.debug('[CREDENTIAL_CHECK] Environment variables:', {
-    hasAnthropicKey,
-    hasEnvOAuthToken,
-  });
 
   if (hasAnthropicKey) {
     logger.info('✓ ANTHROPIC_API_KEY detected');
     return;
   }
 
-  if (hasEnvOAuthToken) {
-    logger.info('✓ CLAUDE_CODE_OAUTH_TOKEN detected');
-    return;
-  }
-
   // Check for Claude Code CLI authentication
-  // Store indicators outside the try block so we can use them in the warning message
-  let cliAuthIndicators: Awaited<ReturnType<typeof getClaudeAuthIndicators>> | null = null;
-
   try {
-    cliAuthIndicators = await getClaudeAuthIndicators();
-    const indicators = cliAuthIndicators;
-
-    // Log detailed credential detection results
-    const { checks, ...indicatorSummary } = indicators;
-    logger.debug('[CREDENTIAL_CHECK] Claude CLI auth indicators:', indicatorSummary);
-
-    logger.debug('[CREDENTIAL_CHECK] File check details:', checks);
-
+    const indicators = await getClaudeAuthIndicators();
     const hasCliAuth =
       indicators.hasStatsCacheWithActivity ||
       (indicators.hasSettingsFile && indicators.hasProjectsSessions) ||
       (indicators.hasCredentialsFile &&
         (indicators.credentials?.hasOAuthToken || indicators.credentials?.hasApiKey));
 
-    logger.debug('[CREDENTIAL_CHECK] Auth determination:', {
-      hasCliAuth,
-      reason: hasCliAuth
-        ? indicators.hasStatsCacheWithActivity
-          ? 'stats cache with activity'
-          : indicators.hasSettingsFile && indicators.hasProjectsSessions
-            ? 'settings file + project sessions'
-            : indicators.credentials?.hasOAuthToken
-              ? 'credentials file with OAuth token'
-              : 'credentials file with API key'
-        : 'no valid credentials found',
-    });
-
     if (hasCliAuth) {
       logger.info('✓ Claude Code CLI authentication detected');
       return;
@@ -185,7 +145,7 @@ const BOX_CONTENT_WIDTH = 67;
     logger.warn('Error checking for Claude Code CLI authentication:', error);
   }
 
-  // No authentication found - show warning with paths that were checked
+  // No authentication found - show warning
   const wHeader = '⚠️  WARNING: No Claude authentication configured'.padEnd(BOX_CONTENT_WIDTH);
   const w1 = 'The Claude Agent SDK requires authentication to function.'.padEnd(BOX_CONTENT_WIDTH);
   const w2 = 'Options:'.padEnd(BOX_CONTENT_WIDTH);
@@ -198,33 +158,6 @@ const BOX_CONTENT_WIDTH = 67;
     BOX_CONTENT_WIDTH
   );
 
-  // Build paths checked summary from the indicators (if available)
-  let pathsCheckedInfo = '';
-  if (cliAuthIndicators) {
-    const pathsChecked: string[] = [];
-
-    // Collect paths that were checked (paths are always populated strings)
-    pathsChecked.push(`Settings: ${cliAuthIndicators.checks.settingsFile.path}`);
-    pathsChecked.push(`Stats cache: ${cliAuthIndicators.checks.statsCache.path}`);
-    pathsChecked.push(`Projects dir: ${cliAuthIndicators.checks.projectsDir.path}`);
-    for (const credFile of cliAuthIndicators.checks.credentialFiles) {
-      pathsChecked.push(`Credentials: ${credFile.path}`);
-    }
-
-    if (pathsChecked.length > 0) {
-      pathsCheckedInfo = `
-║                                                                     ║
-║  ${'Paths checked:'.padEnd(BOX_CONTENT_WIDTH)}║
-${pathsChecked
-  .map((p) => {
-    const maxLen = BOX_CONTENT_WIDTH - 4;
-    const display = p.length > maxLen ? '...' + p.slice(-(maxLen - 3)) : p;
-    return `║    ${display.padEnd(maxLen)}  ║`;
-  })
-  .join('\n')}`;
-    }
-  }
-
   logger.warn(`
 ╔═════════════════════════════════════════════════════════════════════╗
 ║  ${wHeader}║
@@ -236,7 +169,7 @@ ${pathsChecked
 ║  ${w3}║
 ║  ${w4}║
 ║  ${w5}║
-║  ${w6}║${pathsCheckedInfo}
+║  ${w6}║
 ║                                                                     ║
 ╚═════════════════════════════════════════════════════════════════════╝
 `);
@@ -267,26 +200,6 @@ app.use(
 // CORS configuration
 // When using credentials (cookies), origin cannot be '*'
 // We dynamically allow the requesting origin for local development
-
-// Check if origin is a local/private network address
-function isLocalOrigin(origin: string): boolean {
-  try {
-    const url = new URL(origin);
-    const hostname = url.hostname;
-    return (
-      hostname === 'localhost' ||
-      hostname === '127.0.0.1' ||
-      hostname === '[::1]' ||
-      hostname === '0.0.0.0' ||
-      hostname.startsWith('192.168.') ||
-      hostname.startsWith('10.') ||
-      /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname)
-    );
-  } catch {
-    return false;
-  }
-}
-
 app.use(
   cors({
     origin: (origin, callback) => {
@@ -297,25 +210,35 @@ app.use(
       }
 
       // If CORS_ORIGIN is set, use it (can be comma-separated list)
-      const allowedOrigins = process.env.CORS_ORIGIN?.split(',')
-        .map((o) => o.trim())
-        .filter(Boolean);
-      if (allowedOrigins && allowedOrigins.length > 0) {
-        if (allowedOrigins.includes('*')) {
-          callback(null, true);
-          return;
-        }
+      const allowedOrigins = process.env.CORS_ORIGIN?.split(',').map((o) => o.trim());
+      if (allowedOrigins && allowedOrigins.length > 0 && allowedOrigins[0] !== '*') {
         if (allowedOrigins.includes(origin)) {
           callback(null, origin);
+        } else {
+          callback(new Error('Not allowed by CORS'));
+        }
+        return;
+      }
+
+      // For local development, allow all localhost/loopback origins (any port)
+      try {
+        const url = new URL(origin);
+        const hostname = url.hostname;
+
+        if (
+          hostname === 'localhost' ||
+          hostname === '127.0.0.1' ||
+          hostname === '::1' ||
+          hostname === '0.0.0.0' ||
+          hostname.startsWith('192.168.') ||
+          hostname.startsWith('10.') ||
+          hostname.startsWith('172.')
+        ) {
+          callback(null, origin);
           return;
         }
-        // Fall through to local network check below
-      }
-
-      // Allow all localhost/loopback/private network origins (any port)
-      if (isLocalOrigin(origin)) {
-        callback(null, origin);
-        return;
+      } catch (err) {
+        // Ignore URL parsing errors
       }
 
       // Reject other origins by default for security
@@ -342,8 +265,6 @@ const claudeUsageService = new ClaudeUsageService();
 const codexAppServerService = new CodexAppServerService();
 const codexModelCacheService = new CodexModelCacheService(DATA_DIR, codexAppServerService);
 const codexUsageService = new CodexUsageService(codexAppServerService);
-const zaiUsageService = new ZaiUsageService();
-const geminiUsageService = new GeminiUsageService();
 const mcpTestService = new MCPTestService(settingsService);
 const ideationService = new IdeationService(events, settingsService, featureLoader);
 
@@ -384,77 +305,24 @@ eventHookService.initialize(events, settingsService, eventHistoryService, featur
     logger.warn('Failed to check for legacy settings migration:', err);
   }
 
-  // Fetch global settings once and reuse for logging config and feature reconciliation
-  let globalSettings: Awaited<ReturnType<typeof settingsService.getGlobalSettings>> | null = null;
-  try {
-    globalSettings = await settingsService.getGlobalSettings();
-  } catch {
-    logger.warn('Failed to load global settings, using defaults');
-  }
-
   // Apply logging settings from saved settings
-  if (globalSettings) {
-    try {
-      if (
-        globalSettings.serverLogLevel &&
-        LOG_LEVEL_MAP[globalSettings.serverLogLevel] !== undefined
-      ) {
-        setLogLevel(LOG_LEVEL_MAP[globalSettings.serverLogLevel]);
-        logger.info(`Server log level set to: ${globalSettings.serverLogLevel}`);
-      }
-      // Apply request logging setting (default true if not set)
-      const enableRequestLog = globalSettings.enableRequestLogging ?? true;
-      setRequestLoggingEnabled(enableRequestLog);
-      logger.info(`HTTP request logging: ${enableRequestLog ? 'enabled' : 'disabled'}`);
-    } catch {
-      logger.warn('Failed to apply logging settings, using defaults');
+  try {
+    const settings = await settingsService.getGlobalSettings();
+    if (settings.serverLogLevel && LOG_LEVEL_MAP[settings.serverLogLevel] !== undefined) {
+      setLogLevel(LOG_LEVEL_MAP[settings.serverLogLevel]);
+      logger.info(`Server log level set to: ${settings.serverLogLevel}`);
     }
+    // Apply request logging setting (default true if not set)
+    const enableRequestLog = settings.enableRequestLogging ?? true;
+    setRequestLoggingEnabled(enableRequestLog);
+    logger.info(`HTTP request logging: ${enableRequestLog ? 'enabled' : 'disabled'}`);
+  } catch (err) {
+    logger.warn('Failed to load logging settings, using defaults');
   }
 
   await agentService.initialize();
   logger.info('Agent service initialized');
 
-  // Reconcile feature states on startup
-  // After any type of restart (clean, forced, crash), features may be stuck in
-  // transient states (in_progress, interrupted, pipeline_*) that don't match reality.
-  // Reconcile them back to resting states before the UI is served.
-  if (globalSettings) {
-    try {
-      if (globalSettings.projects && globalSettings.projects.length > 0) {
-        let totalReconciled = 0;
-        for (const project of globalSettings.projects) {
-          const count = await autoModeService.reconcileFeatureStates(project.path);
-          totalReconciled += count;
-        }
-        if (totalReconciled > 0) {
-          logger.info(
-            `[STARTUP] Reconciled ${totalReconciled} feature(s) across ${globalSettings.projects.length} project(s)`
-          );
-        } else {
-          logger.info('[STARTUP] Feature state reconciliation complete - no stale states found');
-        }
-
-        // Resume interrupted features in the background after reconciliation.
-        // This uses the saved execution state to identify features that were running
-        // before the restart (their statuses have been reset to ready/backlog by
-        // reconciliation above). Running in background so it doesn't block startup.
-        if (totalReconciled > 0) {
-          for (const project of globalSettings.projects) {
-            autoModeService.resumeInterruptedFeatures(project.path).catch((err) => {
-              logger.warn(
-                `[STARTUP] Failed to resume interrupted features for ${project.path}:`,
-                err
-              );
-            });
-          }
-          logger.info('[STARTUP] Initiated background resume of interrupted features');
-        }
-      }
-    } catch (err) {
-      logger.warn('[STARTUP] Failed to reconcile feature states:', err);
-    }
-  }
-
   // Bootstrap Codex model cache in background (don't block server startup)
   void codexModelCacheService.getModels().catch((err) => {
     logger.error('Failed to bootstrap Codex model cache:', err);
@@ -505,8 +373,6 @@ app.use('/api/terminal', createTerminalRoutes());
 app.use('/api/settings', createSettingsRoutes(settingsService));
 app.use('/api/claude', createClaudeRoutes(claudeUsageService));
 app.use('/api/codex', createCodexRoutes(codexUsageService, codexModelCacheService));
-app.use('/api/zai', createZaiRoutes(zaiUsageService, settingsService));
-app.use('/api/gemini', createGeminiRoutes(geminiUsageService, events));
 app.use('/api/github', createGitHubRoutes(events, settingsService));
 app.use('/api/context', createContextRoutes(settingsService));
 app.use('/api/backlog-plan', createBacklogPlanRoutes(events, settingsService));
@@ -526,7 +392,7 @@ const server = createServer(app);
 // WebSocket servers using noServer mode for proper multi-path support
 const wss = new WebSocketServer({ noServer: true });
 const terminalWss = new WebSocketServer({ noServer: true });
-const terminalService = getTerminalService(settingsService);
+const terminalService = getTerminalService();
 
 /**
  * Authenticate WebSocket upgrade requests
@@ -609,7 +475,7 @@ wss.on('connection', (ws: WebSocket) => {
       logger.info('Sending event to client:', {
         type,
         messageLength: message.length,
-        sessionId: (payload as Record<string, unknown>)?.sessionId,
+        sessionId: (payload as any)?.sessionId,
       });
       ws.send(message);
     } else {
@@ -675,15 +541,8 @@ terminalWss.on('connection', (ws: WebSocket, req: import('http').IncomingMessage
   // Check if session exists
   const session = terminalService.getSession(sessionId);
   if (!session) {
-    logger.warn(
-      `Terminal session ${sessionId} not found. ` +
-        `The session may have exited, been deleted, or was never created. ` +
-        `Active terminal sessions: ${terminalService.getSessionCount()}`
-    );
-    ws.close(
-      4004,
-      'Session not found. The terminal session may have expired or been closed. Please create a new terminal.'
-    );
+    logger.info(`Session ${sessionId} not found`);
+    ws.close(4004, 'Session not found');
     return;
   }
 

apps/server/src/lib/cli-detection.ts

@@ -8,6 +8,9 @@ import { spawn, execSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { createLogger } from '@automaker/utils';
+
+const logger = createLogger('CliDetection');
 
 export interface CliInfo {
   name: string;
@@ -83,7 +86,7 @@ export async function detectCli(
   options: CliDetectionOptions = {}
 ): Promise<CliDetectionResult> {
   const config = CLI_CONFIGS[provider];
-  const { timeout = 5000 } = options;
+  const { timeout = 5000, includeWsl = false, wslDistribution } = options;
   const issues: string[] = [];
 
   const cliInfo: CliInfo = {

apps/server/src/lib/error-handler.ts

@@ -40,7 +40,7 @@ export interface ErrorClassification {
   suggestedAction?: string;
   retryable: boolean;
   provider?: string;
-  context?: Record<string, unknown>;
+  context?: Record<string, any>;
 }
 
 export interface ErrorPattern {
@@ -180,7 +180,7 @@ const ERROR_PATTERNS: ErrorPattern[] = [
 export function classifyError(
   error: unknown,
   provider?: string,
-  context?: Record<string, unknown>
+  context?: Record<string, any>
 ): ErrorClassification {
   const errorText = getErrorText(error);
 
@@ -281,19 +281,18 @@ function getErrorText(error: unknown): string {
 
   if (typeof error === 'object' && error !== null) {
     // Handle structured error objects
-    const errorObj = error as Record<string, unknown>;
+    const errorObj = error as any;
 
-    if (typeof errorObj.message === 'string') {
+    if (errorObj.message) {
       return errorObj.message;
     }
 
-    const nestedError = errorObj.error;
-    if (typeof nestedError === 'object' && nestedError !== null && 'message' in nestedError) {
-      return String((nestedError as Record<string, unknown>).message);
+    if (errorObj.error?.message) {
+      return errorObj.error.message;
     }
 
-    if (nestedError) {
-      return typeof nestedError === 'string' ? nestedError : JSON.stringify(nestedError);
+    if (errorObj.error) {
+      return typeof errorObj.error === 'string' ? errorObj.error : JSON.stringify(errorObj.error);
     }
 
     return JSON.stringify(error);
@@ -308,7 +307,7 @@ function getErrorText(error: unknown): string {
 export function createErrorResponse(
   error: unknown,
   provider?: string,
-  context?: Record<string, unknown>
+  context?: Record<string, any>
 ): {
   success: false;
   error: string;
@@ -336,7 +335,7 @@ export function logError(
   error: unknown,
   provider?: string,
   operation?: string,
-  additionalContext?: Record<string, unknown>
+  additionalContext?: Record<string, any>
 ): void {
   const classification = classifyError(error, provider, {
     operation,

apps/server/src/lib/exec-utils.ts

@@ -1,37 +0,0 @@
-/**
- * Shared execution utilities
- *
- * Common helpers for spawning child processes with the correct environment.
- * Used by both route handlers and service layers.
- */
-
-import { createLogger } from '@automaker/utils';
-
-const logger = createLogger('ExecUtils');
-
-// Extended PATH to include common tool installation locations
-export const extendedPath = [
-  process.env.PATH,
-  '/opt/homebrew/bin',
-  '/usr/local/bin',
-  '/home/linuxbrew/.linuxbrew/bin',
-  `${process.env.HOME}/.local/bin`,
-]
-  .filter(Boolean)
-  .join(':');
-
-export const execEnv = {
-  ...process.env,
-  PATH: extendedPath,
-};
-
-export function getErrorMessage(error: unknown): string {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  return String(error);
-}
-
-export function logError(error: unknown, context: string): void {
-  logger.error(`${context}:`, error);
-}

apps/server/src/lib/git-log-parser.ts

@@ -1,62 +0,0 @@
-export interface CommitFields {
-  hash: string;
-  shortHash: string;
-  author: string;
-  authorEmail: string;
-  date: string;
-  subject: string;
-  body: string;
-}
-
-export function parseGitLogOutput(output: string): CommitFields[] {
-  const commits: CommitFields[] = [];
-
-  // Split by NUL character to separate commits
-  const commitBlocks = output.split('\0').filter((block) => block.trim());
-
-  for (const block of commitBlocks) {
-    const allLines = block.split('\n');
-
-    // Skip leading empty lines that may appear at block boundaries
-    let startIndex = 0;
-    while (startIndex < allLines.length && allLines[startIndex].trim() === '') {
-      startIndex++;
-    }
-    const fields = allLines.slice(startIndex);
-
-    // Validate we have all expected fields (at least hash, shortHash, author, authorEmail, date, subject)
-    if (fields.length < 6) {
-      continue; // Skip malformed blocks
-    }
-
-    const commit: CommitFields = {
-      hash: fields[0].trim(),
-      shortHash: fields[1].trim(),
-      author: fields[2].trim(),
-      authorEmail: fields[3].trim(),
-      date: fields[4].trim(),
-      subject: fields[5].trim(),
-      body: fields.slice(6).join('\n').trim(),
-    };
-
-    commits.push(commit);
-  }
-
-  return commits;
-}
-
-/**
- * Creates a commit object from parsed fields, matching the expected API response format
- */
-export function createCommitFromFields(fields: CommitFields, files?: string[]) {
-  return {
-    hash: fields.hash,
-    shortHash: fields.shortHash,
-    author: fields.author,
-    authorEmail: fields.authorEmail,
-    date: fields.date,
-    subject: fields.subject,
-    body: fields.body,
-    files: files || [],
-  };
-}

apps/server/src/lib/git.ts

@@ -1,208 +0,0 @@
-/**
- * Shared git command execution utilities.
- *
- * This module provides the canonical `execGitCommand` helper and common
- * git utilities used across services and routes.  All consumers should
- * import from here rather than defining their own copy.
- */
-
-import fs from 'fs/promises';
-import path from 'path';
-import { spawnProcess } from '@automaker/platform';
-import { createLogger } from '@automaker/utils';
-
-const logger = createLogger('GitLib');
-
-// ============================================================================
-// Secure Command Execution
-// ============================================================================
-
-/**
- * Execute git command with array arguments to prevent command injection.
- * Uses spawnProcess from @automaker/platform for secure, cross-platform execution.
- *
- * @param args - Array of git command arguments (e.g., ['worktree', 'add', path])
- * @param cwd - Working directory to execute the command in
- * @param env - Optional additional environment variables to pass to the git process.
- *   These are merged on top of the current process environment.  Pass
- *   `{ LC_ALL: 'C' }` to force git to emit English output regardless of the
- *   system locale so that text-based output parsing remains reliable.
- * @param abortController - Optional AbortController to cancel the git process.
- *   When the controller is aborted the underlying process is sent SIGTERM and
- *   the returned promise rejects with an Error whose message is 'Process aborted'.
- * @returns Promise resolving to stdout output
- * @throws Error with stderr/stdout message if command fails. The thrown error
- *   also has `stdout` and `stderr` string properties for structured access.
- *
- * @example
- * ```typescript
- * // Safe: no injection possible
- * await execGitCommand(['branch', '-D', branchName], projectPath);
- *
- * // Force English output for reliable text parsing:
- * await execGitCommand(['rebase', '--', 'main'], worktreePath, { LC_ALL: 'C' });
- *
- * // With a process-level timeout:
- * const controller = new AbortController();
- * const timerId = setTimeout(() => controller.abort(), 30_000);
- * try {
- *   await execGitCommand(['fetch', '--all', '--quiet'], cwd, undefined, controller);
- * } finally {
- *   clearTimeout(timerId);
- * }
- *
- * // Instead of unsafe:
- * // await execAsync(`git branch -D ${branchName}`, { cwd });
- * ```
- */
-export async function execGitCommand(
-  args: string[],
-  cwd: string,
-  env?: Record<string, string>,
-  abortController?: AbortController
-): Promise<string> {
-  const result = await spawnProcess({
-    command: 'git',
-    args,
-    cwd,
-    ...(env !== undefined ? { env } : {}),
-    ...(abortController !== undefined ? { abortController } : {}),
-  });
-
-  // spawnProcess returns { stdout, stderr, exitCode }
-  if (result.exitCode === 0) {
-    return result.stdout;
-  } else {
-    const errorMessage =
-      result.stderr || result.stdout || `Git command failed with code ${result.exitCode}`;
-    throw Object.assign(new Error(errorMessage), {
-      stdout: result.stdout,
-      stderr: result.stderr,
-    });
-  }
-}
-
-// ============================================================================
-// Common Git Utilities
-// ============================================================================
-
-/**
- * Get the current branch name for the given worktree.
- *
- * This is the canonical implementation shared across services.  Services
- * should import this rather than duplicating the logic locally.
- *
- * @param worktreePath - Path to the git worktree
- * @returns The current branch name (trimmed)
- */
-export async function getCurrentBranch(worktreePath: string): Promise<string> {
-  const branchOutput = await execGitCommand(['rev-parse', '--abbrev-ref', 'HEAD'], worktreePath);
-  return branchOutput.trim();
-}
-
-// ============================================================================
-// Index Lock Recovery
-// ============================================================================
-
-/**
- * Check whether an error message indicates a stale git index lock file.
- *
- * Git operations that write to the index (e.g. `git stash push`) will fail
- * with "could not write index" or "Unable to create ... .lock" when a
- * `.git/index.lock` file exists from a previously interrupted operation.
- *
- * @param errorMessage - The error string from a failed git command
- * @returns true if the error looks like a stale index lock issue
- */
-export function isIndexLockError(errorMessage: string): boolean {
-  const lower = errorMessage.toLowerCase();
-  return (
-    lower.includes('could not write index') ||
-    (lower.includes('unable to create') && lower.includes('index.lock')) ||
-    lower.includes('index.lock')
-  );
-}
-
-/**
- * Attempt to remove a stale `.git/index.lock` file for the given worktree.
- *
- * Uses `git rev-parse --git-dir` to locate the correct `.git` directory,
- * which works for both regular repositories and linked worktrees.
- *
- * @param worktreePath - Path to the git worktree (or main repo)
- * @returns true if a lock file was found and removed, false otherwise
- */
-export async function removeStaleIndexLock(worktreePath: string): Promise<boolean> {
-  try {
-    // Resolve the .git directory (handles worktrees correctly)
-    const gitDirRaw = await execGitCommand(['rev-parse', '--git-dir'], worktreePath);
-    const gitDir = path.resolve(worktreePath, gitDirRaw.trim());
-    const lockFilePath = path.join(gitDir, 'index.lock');
-
-    // Check if the lock file exists
-    try {
-      await fs.access(lockFilePath);
-    } catch {
-      // Lock file does not exist — nothing to remove
-      return false;
-    }
-
-    // Remove the stale lock file
-    await fs.unlink(lockFilePath);
-    logger.info('Removed stale index.lock file', { worktreePath, lockFilePath });
-    return true;
-  } catch (err) {
-    logger.warn('Failed to remove stale index.lock file', {
-      worktreePath,
-      error: err instanceof Error ? err.message : String(err),
-    });
-    return false;
-  }
-}
-
-/**
- * Execute a git command with automatic retry when a stale index.lock is detected.
- *
- * If the command fails with an error indicating a locked index file, this
- * helper will attempt to remove the stale `.git/index.lock` and retry the
- * command exactly once.
- *
- * This is particularly useful for `git stash push` which writes to the
- * index and commonly fails when a previous git operation was interrupted.
- *
- * @param args - Array of git command arguments
- * @param cwd - Working directory to execute the command in
- * @param env - Optional additional environment variables
- * @returns Promise resolving to stdout output
- * @throws The original error if retry also fails, or a non-lock error
- */
-export async function execGitCommandWithLockRetry(
-  args: string[],
-  cwd: string,
-  env?: Record<string, string>
-): Promise<string> {
-  try {
-    return await execGitCommand(args, cwd, env);
-  } catch (error: unknown) {
-    const err = error as { message?: string; stderr?: string };
-    const errorMessage = err.stderr || err.message || '';
-
-    if (!isIndexLockError(errorMessage)) {
-      throw error;
-    }
-
-    logger.info('Git command failed due to index lock, attempting cleanup and retry', {
-      cwd,
-      args: args.join(' '),
-    });
-
-    const removed = await removeStaleIndexLock(cwd);
-    if (!removed) {
-      // Could not remove the lock file — re-throw the original error
-      throw error;
-    }
-
-    // Retry the command once after removing the lock file
-    return await execGitCommand(args, cwd, env);
-  }
-}

apps/server/src/lib/permission-enforcer.ts

@@ -12,18 +12,11 @@ export interface PermissionCheckResult {
   reason?: string;
 }
 
-/** Minimal shape of a Cursor tool call used for permission checking */
-interface CursorToolCall {
-  shellToolCall?: { args?: { command: string } };
-  readToolCall?: { args?: { path: string } };
-  writeToolCall?: { args?: { path: string } };
-}
-
 /**
  * Check if a tool call is allowed based on permissions
  */
 export function checkToolCallPermission(
-  toolCall: CursorToolCall,
+  toolCall: any,
   permissions: CursorCliConfigFile | null
 ): PermissionCheckResult {
   if (!permissions || !permissions.permissions) {
@@ -159,11 +152,7 @@ function matchesRule(toolName: string, rule: string): boolean {
 /**
  * Log permission violations
  */
-export function logPermissionViolation(
-  toolCall: CursorToolCall,
-  reason: string,
-  sessionId?: string
-): void {
+export function logPermissionViolation(toolCall: any, reason: string, sessionId?: string): void {
   const sessionIdStr = sessionId ? ` [${sessionId}]` : '';
 
   if (toolCall.shellToolCall?.args?.command) {

apps/server/src/lib/sdk-options.ts

@@ -133,16 +133,12 @@ export const TOOL_PRESETS = {
     'Read',
     'Write',
     'Edit',
-    'MultiEdit',
     'Glob',
     'Grep',
-    'LS',
     'Bash',
     'WebSearch',
     'WebFetch',
     'TodoWrite',
-    'Task',
-    'Skill',
   ] as const,
 
   /** Tools for chat/interactive mode */
@@ -150,16 +146,12 @@ export const TOOL_PRESETS = {
     'Read',
     'Write',
     'Edit',
-    'MultiEdit',
     'Glob',
     'Grep',
-    'LS',
     'Bash',
     'WebSearch',
     'WebFetch',
     'TodoWrite',
-    'Task',
-    'Skill',
   ] as const,
 } as const;
 
@@ -261,27 +253,11 @@ function buildMcpOptions(config: CreateSdkOptionsConfig): McpOptions {
 /**
  * Build thinking options for SDK configuration.
  * Converts ThinkingLevel to maxThinkingTokens for the Claude SDK.
- * For adaptive thinking (Opus 4.6), omits maxThinkingTokens to let the model
- * decide its own reasoning depth.
  *
  * @param thinkingLevel - The thinking level to convert
- * @returns Object with maxThinkingTokens if thinking is enabled with a budget
+ * @returns Object with maxThinkingTokens if thinking is enabled
  */
 function buildThinkingOptions(thinkingLevel?: ThinkingLevel): Partial<Options> {
-  if (!thinkingLevel || thinkingLevel === 'none') {
-    return {};
-  }
-
-  // Adaptive thinking (Opus 4.6): don't set maxThinkingTokens
-  // The model will use adaptive thinking by default
-  if (thinkingLevel === 'adaptive') {
-    logger.debug(
-      `buildThinkingOptions: thinkingLevel="adaptive" -> no maxThinkingTokens (model decides)`
-    );
-    return {};
-  }
-
-  // Manual budget-based thinking for Haiku/Sonnet
   const maxThinkingTokens = getThinkingTokenBudget(thinkingLevel);
   logger.debug(
     `buildThinkingOptions: thinkingLevel="${thinkingLevel}" -> maxThinkingTokens=${maxThinkingTokens}`
@@ -290,15 +266,11 @@ function buildThinkingOptions(thinkingLevel?: ThinkingLevel): Partial<Options> {
 }
 
 /**
- * Build system prompt and settingSources based on two independent settings:
- * - useClaudeCodeSystemPrompt: controls whether to use the 'claude_code' preset as the base prompt
- * - autoLoadClaudeMd: controls whether to add settingSources for SDK to load CLAUDE.md files
- *
- * These combine independently (4 possible states):
- * 1. Both ON: preset + settingSources (full Claude Code experience)
- * 2. useClaudeCodeSystemPrompt ON, autoLoadClaudeMd OFF: preset only (no CLAUDE.md auto-loading)
- * 3. useClaudeCodeSystemPrompt OFF, autoLoadClaudeMd ON: plain string + settingSources
- * 4. Both OFF: plain string only
+ * Build system prompt configuration based on autoLoadClaudeMd setting.
+ * When autoLoadClaudeMd is true:
+ * - Uses preset mode with 'claude_code' to enable CLAUDE.md auto-loading
+ * - If there's a custom systemPrompt, appends it to the preset
+ * - Sets settingSources to ['project'] for SDK to load CLAUDE.md files
  *
  * @param config - The SDK options config
  * @returns Object with systemPrompt and settingSources for SDK options
@@ -307,34 +279,27 @@ function buildClaudeMdOptions(config: CreateSdkOptionsConfig): {
   systemPrompt?: string | SystemPromptConfig;
   settingSources?: Array<'user' | 'project' | 'local'>;
 } {
-  const result: {
-    systemPrompt?: string | SystemPromptConfig;
-    settingSources?: Array<'user' | 'project' | 'local'>;
-  } = {};
-
-  // Determine system prompt format based on useClaudeCodeSystemPrompt
-  if (config.useClaudeCodeSystemPrompt) {
-    // Use Claude Code's built-in system prompt as the base
-    const presetConfig: SystemPromptConfig = {
-      type: 'preset',
-      preset: 'claude_code',
-    };
-    // If there's a custom system prompt, append it to the preset
-    if (config.systemPrompt) {
-      presetConfig.append = config.systemPrompt;
-    }
-    result.systemPrompt = presetConfig;
-  } else {
+  if (!config.autoLoadClaudeMd) {
     // Standard mode - just pass through the system prompt as-is
-    if (config.systemPrompt) {
-      result.systemPrompt = config.systemPrompt;
-    }
+    return config.systemPrompt ? { systemPrompt: config.systemPrompt } : {};
   }
 
-  // Determine settingSources based on autoLoadClaudeMd
-  if (config.autoLoadClaudeMd) {
+  // Auto-load CLAUDE.md mode - use preset with settingSources
+  const result: {
+    systemPrompt: SystemPromptConfig;
+    settingSources: Array<'user' | 'project' | 'local'>;
+  } = {
+    systemPrompt: {
+      type: 'preset',
+      preset: 'claude_code',
+    },
     // Load both user (~/.claude/CLAUDE.md) and project (.claude/CLAUDE.md) settings
-    result.settingSources = ['user', 'project'];
+    settingSources: ['user', 'project'],
+  };
+
+  // If there's a custom system prompt, append it to the preset
+  if (config.systemPrompt) {
+    result.systemPrompt.append = config.systemPrompt;
   }
 
   return result;
@@ -342,14 +307,12 @@ function buildClaudeMdOptions(config: CreateSdkOptionsConfig): {
 
 /**
  * System prompt configuration for SDK options
- * The 'claude_code' preset provides the system prompt only — it does NOT auto-load
- * CLAUDE.md files. CLAUDE.md auto-loading is controlled independently by
- * settingSources (set via autoLoadClaudeMd). These two settings are orthogonal.
+ * When using preset mode with claude_code, CLAUDE.md files are automatically loaded
  */
 export interface SystemPromptConfig {
-  /** Use preset mode to select the base system prompt */
+  /** Use preset mode with claude_code to enable CLAUDE.md auto-loading */
   type: 'preset';
-  /** The preset to use - 'claude_code' uses the Claude Code system prompt */
+  /** The preset to use - 'claude_code' enables CLAUDE.md loading */
   preset: 'claude_code';
   /** Optional additional prompt to append to the preset */
   append?: string;
@@ -383,19 +346,11 @@ export interface CreateSdkOptionsConfig {
   /** Enable auto-loading of CLAUDE.md files via SDK's settingSources */
   autoLoadClaudeMd?: boolean;
 
-  /** Use Claude Code's built-in system prompt (claude_code preset) as the base prompt */
-  useClaudeCodeSystemPrompt?: boolean;
-
   /** MCP servers to make available to the agent */
   mcpServers?: Record<string, McpServerConfig>;
 
   /** Extended thinking level for Claude models */
   thinkingLevel?: ThinkingLevel;
-
-  /** Optional user-configured max turns override (from settings).
-   * When provided, overrides the preset MAX_TURNS for the use case.
-   * Range: 1-2000. */
-  maxTurns?: number;
 }
 
 // Re-export MCP types from @automaker/types for convenience
@@ -432,7 +387,7 @@ export function createSpecGenerationOptions(config: CreateSdkOptionsConfig): Opt
     // See: https://github.com/AutoMaker-Org/automaker/issues/149
     permissionMode: 'default',
     model: getModelForUseCase('spec', config.model),
-    maxTurns: config.maxTurns ?? MAX_TURNS.maximum,
+    maxTurns: MAX_TURNS.maximum,
     cwd: config.cwd,
     allowedTools: [...TOOL_PRESETS.specGeneration],
     ...claudeMdOptions,
@@ -466,7 +421,7 @@ export function createFeatureGenerationOptions(config: CreateSdkOptionsConfig):
     // Override permissionMode - feature generation only needs read-only tools
     permissionMode: 'default',
     model: getModelForUseCase('features', config.model),
-    maxTurns: config.maxTurns ?? MAX_TURNS.quick,
+    maxTurns: MAX_TURNS.quick,
     cwd: config.cwd,
     allowedTools: [...TOOL_PRESETS.readOnly],
     ...claudeMdOptions,
@@ -497,7 +452,7 @@ export function createSuggestionsOptions(config: CreateSdkOptionsConfig): Option
   return {
     ...getBaseOptions(),
     model: getModelForUseCase('suggestions', config.model),
-    maxTurns: config.maxTurns ?? MAX_TURNS.extended,
+    maxTurns: MAX_TURNS.extended,
     cwd: config.cwd,
     allowedTools: [...TOOL_PRESETS.readOnly],
     ...claudeMdOptions,
@@ -535,7 +490,7 @@ export function createChatOptions(config: CreateSdkOptionsConfig): Options {
   return {
     ...getBaseOptions(),
     model: getModelForUseCase('chat', effectiveModel),
-    maxTurns: config.maxTurns ?? MAX_TURNS.standard,
+    maxTurns: MAX_TURNS.standard,
     cwd: config.cwd,
     allowedTools: [...TOOL_PRESETS.chat],
     ...claudeMdOptions,
@@ -570,7 +525,7 @@ export function createAutoModeOptions(config: CreateSdkOptionsConfig): Options {
   return {
     ...getBaseOptions(),
     model: getModelForUseCase('auto', config.model),
-    maxTurns: config.maxTurns ?? MAX_TURNS.maximum,
+    maxTurns: MAX_TURNS.maximum,
     cwd: config.cwd,
     allowedTools: [...TOOL_PRESETS.fullAccess],
     ...claudeMdOptions,

apps/server/src/lib/settings-helpers.ts

@@ -33,16 +33,9 @@ import {
 
 const logger = createLogger('SettingsHelper');
 
-/** Default number of agent turns used when no value is configured. */
-export const DEFAULT_MAX_TURNS = 10000;
-
-/** Upper bound for the max-turns clamp; values above this are capped here. */
-export const MAX_ALLOWED_TURNS = 10000;
-
 /**
  * Get the autoLoadClaudeMd setting, with project settings taking precedence over global.
- * Falls back to global settings and defaults to true when unset.
- * Returns true if settings service is not available.
+ * Returns false if settings service is not available.
  *
  * @param projectPath - Path to the project
  * @param settingsService - Optional settings service instance
@@ -55,8 +48,8 @@ export async function getAutoLoadClaudeMdSetting(
   logPrefix = '[SettingsHelper]'
 ): Promise<boolean> {
   if (!settingsService) {
-    logger.info(`${logPrefix} SettingsService not available, autoLoadClaudeMd defaulting to true`);
-    return true;
+    logger.info(`${logPrefix} SettingsService not available, autoLoadClaudeMd disabled`);
+    return false;
   }
 
   try {
@@ -71,7 +64,7 @@ export async function getAutoLoadClaudeMdSetting(
 
     // Fall back to global settings
     const globalSettings = await settingsService.getGlobalSettings();
-    const result = globalSettings.autoLoadClaudeMd ?? true;
+    const result = globalSettings.autoLoadClaudeMd ?? false;
     logger.info(`${logPrefix} autoLoadClaudeMd from global settings: ${result}`);
     return result;
   } catch (error) {
@@ -80,84 +73,6 @@ export async function getAutoLoadClaudeMdSetting(
   }
 }
 
-/**
- * Get the useClaudeCodeSystemPrompt setting, with project settings taking precedence over global.
- * Falls back to global settings and defaults to true when unset.
- * Returns true if settings service is not available.
- *
- * @param projectPath - Path to the project
- * @param settingsService - Optional settings service instance
- * @param logPrefix - Prefix for log messages (e.g., '[AgentService]')
- * @returns Promise resolving to the useClaudeCodeSystemPrompt setting value
- */
-export async function getUseClaudeCodeSystemPromptSetting(
-  projectPath: string,
-  settingsService?: SettingsService | null,
-  logPrefix = '[SettingsHelper]'
-): Promise<boolean> {
-  if (!settingsService) {
-    logger.info(
-      `${logPrefix} SettingsService not available, useClaudeCodeSystemPrompt defaulting to true`
-    );
-    return true;
-  }
-
-  try {
-    // Check project settings first (takes precedence)
-    const projectSettings = await settingsService.getProjectSettings(projectPath);
-    if (projectSettings.useClaudeCodeSystemPrompt !== undefined) {
-      logger.info(
-        `${logPrefix} useClaudeCodeSystemPrompt from project settings: ${projectSettings.useClaudeCodeSystemPrompt}`
-      );
-      return projectSettings.useClaudeCodeSystemPrompt;
-    }
-
-    // Fall back to global settings
-    const globalSettings = await settingsService.getGlobalSettings();
-    const result = globalSettings.useClaudeCodeSystemPrompt ?? true;
-    logger.info(`${logPrefix} useClaudeCodeSystemPrompt from global settings: ${result}`);
-    return result;
-  } catch (error) {
-    logger.error(`${logPrefix} Failed to load useClaudeCodeSystemPrompt setting:`, error);
-    throw error;
-  }
-}
-
-/**
- * Get the default max turns setting from global settings.
- *
- * Reads the user's configured `defaultMaxTurns` setting, which controls the maximum
- * number of agent turns (tool-call round-trips) for feature execution.
- *
- * @param settingsService - Settings service instance (may be null)
- * @param logPrefix - Logging prefix for debugging
- * @returns The user's configured max turns, or {@link DEFAULT_MAX_TURNS} as default
- */
-export async function getDefaultMaxTurnsSetting(
-  settingsService?: SettingsService | null,
-  logPrefix = '[SettingsHelper]'
-): Promise<number> {
-  if (!settingsService) {
-    logger.info(
-      `${logPrefix} SettingsService not available, using default maxTurns=${DEFAULT_MAX_TURNS}`
-    );
-    return DEFAULT_MAX_TURNS;
-  }
-
-  try {
-    const globalSettings = await settingsService.getGlobalSettings();
-    const raw = globalSettings.defaultMaxTurns;
-    const result = Number.isFinite(raw) ? (raw as number) : DEFAULT_MAX_TURNS;
-    // Clamp to valid range
-    const clamped = Math.max(1, Math.min(MAX_ALLOWED_TURNS, Math.floor(result)));
-    logger.debug(`${logPrefix} defaultMaxTurns from global settings: ${clamped}`);
-    return clamped;
-  } catch (error) {
-    logger.error(`${logPrefix} Failed to load defaultMaxTurns setting:`, error);
-    return DEFAULT_MAX_TURNS;
-  }
-}
-
 /**
  * Filters out CLAUDE.md from context files when autoLoadClaudeMd is enabled
  * and rebuilds the formatted prompt without it.

apps/server/src/lib/terminal-themes-data.ts

@@ -1,25 +0,0 @@
-/**
- * Terminal Theme Data - Re-export terminal themes from platform package
- *
- * This module re-exports terminal theme data for use in the server.
- */
-
-import { terminalThemeColors, getTerminalThemeColors as getThemeColors } from '@automaker/platform';
-import type { ThemeMode } from '@automaker/types';
-import type { TerminalTheme } from '@automaker/platform';
-
-/**
- * Get terminal theme colors for a given theme mode
- */
-export function getTerminalThemeColors(theme: ThemeMode): TerminalTheme {
-  return getThemeColors(theme);
-}
-
-/**
- * Get all terminal themes
- */
-export function getAllTerminalThemes(): Record<ThemeMode, TerminalTheme> {
-  return terminalThemeColors;
-}
-
-export default terminalThemeColors;

apps/server/src/lib/worktree-metadata.ts

@@ -78,7 +78,7 @@ export async function readWorktreeMetadata(
     const metadataPath = getWorktreeMetadataPath(projectPath, branch);
     const content = (await secureFs.readFile(metadataPath, 'utf-8')) as string;
     return JSON.parse(content) as WorktreeMetadata;
-  } catch (_error) {
+  } catch (error) {
     // File doesn't exist or can't be read
     return null;
   }

apps/server/src/providers/claude-provider.ts

@@ -5,10 +5,11 @@
  * with the provider architecture.
  */
 
-import { query, type Options, type SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
+import { query, type Options } from '@anthropic-ai/claude-agent-sdk';
 import { BaseProvider } from './base-provider.js';
 import { classifyError, getUserFriendlyErrorMessage, createLogger } from '@automaker/utils';
-import { getClaudeAuthIndicators } from '@automaker/platform';
+
+const logger = createLogger('ClaudeProvider');
 import {
   getThinkingTokenBudget,
   validateBareModelId,
@@ -16,14 +17,6 @@ import {
   type ClaudeCompatibleProvider,
   type Credentials,
 } from '@automaker/types';
-import type {
-  ExecuteOptions,
-  ProviderMessage,
-  InstallationStatus,
-  ModelDefinition,
-} from './types.js';
-
-const logger = createLogger('ClaudeProvider');
 
 /**
  * ProviderConfig - Union type for provider configuration
@@ -32,11 +25,29 @@ const logger = createLogger('ClaudeProvider');
  * Both share the same connection settings structure.
  */
 type ProviderConfig = ClaudeApiProfile | ClaudeCompatibleProvider;
+import type {
+  ExecuteOptions,
+  ProviderMessage,
+  InstallationStatus,
+  ModelDefinition,
+} from './types.js';
 
-// System vars are always passed from process.env regardless of profile.
-// Includes filesystem, locale, and temp directory vars that the Claude CLI
-// needs internally for config resolution and temp file creation.
-const SYSTEM_ENV_VARS = [
+// Explicit allowlist of environment variables to pass to the SDK.
+// Only these vars are passed - nothing else from process.env leaks through.
+const ALLOWED_ENV_VARS = [
+  // Authentication
+  'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  // Endpoint configuration
+  'ANTHROPIC_BASE_URL',
+  'API_TIMEOUT_MS',
+  // Model mappings
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL',
+  // Traffic control
+  'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC',
+  // System vars (always from process.env)
   'PATH',
   'HOME',
   'SHELL',
@@ -44,13 +55,11 @@ const SYSTEM_ENV_VARS = [
   'USER',
   'LANG',
   'LC_ALL',
-  'TMPDIR',
-  'XDG_CONFIG_HOME',
-  'XDG_DATA_HOME',
-  'XDG_CACHE_HOME',
-  'XDG_STATE_HOME',
 ];
 
+// System vars are always passed from process.env regardless of profile
+const SYSTEM_ENV_VARS = ['PATH', 'HOME', 'SHELL', 'TERM', 'USER', 'LANG', 'LC_ALL'];
+
 /**
  * Check if the config is a ClaudeCompatibleProvider (new system)
  * by checking for the 'models' array property
@@ -195,7 +204,7 @@ export class ClaudeProvider extends BaseProvider {
       model,
       cwd,
       systemPrompt,
-      maxTurns = 1000,
+      maxTurns = 20,
       allowedTools,
       abortController,
       conversationHistory,
@@ -210,11 +219,8 @@ export class ClaudeProvider extends BaseProvider {
     // claudeCompatibleProvider takes precedence over claudeApiProfile
     const providerConfig = claudeCompatibleProvider || claudeApiProfile;
 
-    // Build thinking configuration
-    // Adaptive thinking (Opus 4.6): don't set maxThinkingTokens, model uses adaptive by default
-    // Manual thinking (Haiku/Sonnet): use budget_tokens
-    const maxThinkingTokens =
-      thinkingLevel === 'adaptive' ? undefined : getThinkingTokenBudget(thinkingLevel);
+    // Convert thinking level to token budget
+    const maxThinkingTokens = getThinkingTokenBudget(thinkingLevel);
 
     // Build Claude SDK options
     const sdkOptions: Options = {
@@ -228,8 +234,6 @@ export class ClaudeProvider extends BaseProvider {
       env: buildEnv(providerConfig, credentials),
       // Pass through allowedTools if provided by caller (decided by sdk-options.ts)
       ...(allowedTools && { allowedTools }),
-      // Restrict available built-in tools if specified (tools: [] disables all tools)
-      ...(options.tools && { tools: options.tools }),
       // AUTONOMOUS MODE: Always bypass permissions for fully autonomous operation
       permissionMode: 'bypassPermissions',
       allowDangerouslySkipPermissions: true,
@@ -251,14 +255,14 @@ export class ClaudeProvider extends BaseProvider {
     };
 
     // Build prompt payload
-    let promptPayload: string | AsyncIterable<SDKUserMessage>;
+    let promptPayload: string | AsyncIterable<any>;
 
     if (Array.isArray(prompt)) {
       // Multi-part prompt (with images)
       promptPayload = (async function* () {
-        const multiPartPrompt: SDKUserMessage = {
+        const multiPartPrompt = {
           type: 'user' as const,
-          session_id: sdkSessionId || '',
+          session_id: '',
           message: {
             role: 'user' as const,
             content: prompt,
@@ -310,16 +314,12 @@ export class ClaudeProvider extends BaseProvider {
         ? `${userMessage}\n\nTip: If you're running multiple features in auto-mode, consider reducing concurrency (maxConcurrency setting) to avoid hitting rate limits.`
         : userMessage;
 
-      const enhancedError = new Error(message) as Error & {
-        originalError: unknown;
-        type: string;
-        retryAfter?: number;
-      };
-      enhancedError.originalError = error;
-      enhancedError.type = errorInfo.type;
+      const enhancedError = new Error(message);
+      (enhancedError as any).originalError = error;
+      (enhancedError as any).type = errorInfo.type;
 
       if (errorInfo.isRateLimit) {
-        enhancedError.retryAfter = errorInfo.retryAfter;
+        (enhancedError as any).retryAfter = errorInfo.retryAfter;
       }
 
       throw enhancedError;
@@ -331,37 +331,13 @@ export class ClaudeProvider extends BaseProvider {
    */
   async detectInstallation(): Promise<InstallationStatus> {
     // Claude SDK is always available since it's a dependency
-    // Check all four supported auth methods, mirroring the logic in buildEnv():
-    // 1. ANTHROPIC_API_KEY environment variable
-    // 2. ANTHROPIC_AUTH_TOKEN environment variable
-    // 3. credentials?.apiKeys?.anthropic (credentials file, checked via platform indicators)
-    // 4. Claude Max CLI OAuth (SDK handles this automatically; detected via getClaudeAuthIndicators)
-    const hasEnvApiKey = !!process.env.ANTHROPIC_API_KEY;
-    const hasEnvAuthToken = !!process.env.ANTHROPIC_AUTH_TOKEN;
-
-    // Check credentials file and CLI OAuth indicators (same sources used by buildEnv)
-    let hasCredentialsApiKey = false;
-    let hasCliOAuth = false;
-    try {
-      const indicators = await getClaudeAuthIndicators();
-      hasCredentialsApiKey = !!indicators.credentials?.hasApiKey;
-      hasCliOAuth = !!(
-        indicators.credentials?.hasOAuthToken ||
-        indicators.hasStatsCacheWithActivity ||
-        (indicators.hasSettingsFile && indicators.hasProjectsSessions)
-      );
-    } catch {
-      // If we can't check indicators, fall back to env vars only
-    }
-
-    const hasApiKey = hasEnvApiKey || hasCredentialsApiKey;
-    const authenticated = hasEnvApiKey || hasEnvAuthToken || hasCredentialsApiKey || hasCliOAuth;
+    const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
 
     const status: InstallationStatus = {
       installed: true,
       method: 'sdk',
       hasApiKey,
-      authenticated,
+      authenticated: hasApiKey,
     };
 
     return status;
@@ -373,30 +349,18 @@ export class ClaudeProvider extends BaseProvider {
   getAvailableModels(): ModelDefinition[] {
     const models = [
       {
-        id: 'claude-opus-4-6',
-        name: 'Claude Opus 4.6',
-        modelString: 'claude-opus-4-6',
+        id: 'claude-opus-4-5-20251101',
+        name: 'Claude Opus 4.5',
+        modelString: 'claude-opus-4-5-20251101',
         provider: 'anthropic',
-        description: 'Most capable Claude model with adaptive thinking',
+        description: 'Most capable Claude model',
         contextWindow: 200000,
-        maxOutputTokens: 128000,
+        maxOutputTokens: 16000,
         supportsVision: true,
         supportsTools: true,
         tier: 'premium' as const,
         default: true,
       },
-      {
-        id: 'claude-sonnet-4-6',
-        name: 'Claude Sonnet 4.6',
-        modelString: 'claude-sonnet-4-6',
-        provider: 'anthropic',
-        description: 'Balanced performance and cost with enhanced reasoning',
-        contextWindow: 200000,
-        maxOutputTokens: 64000,
-        supportsVision: true,
-        supportsTools: true,
-        tier: 'standard' as const,
-      },
       {
         id: 'claude-sonnet-4-20250514',
         name: 'Claude Sonnet 4',

apps/server/src/providers/codex-models.ts

@@ -19,11 +19,12 @@ const MAX_OUTPUT_16K = 16000;
 export const CODEX_MODELS: ModelDefinition[] = [
   // ========== Recommended Codex Models ==========
   {
-    id: CODEX_MODEL_MAP.gpt53Codex,
-    name: 'GPT-5.3-Codex',
-    modelString: CODEX_MODEL_MAP.gpt53Codex,
+    id: CODEX_MODEL_MAP.gpt52Codex,
+    name: 'GPT-5.2-Codex',
+    modelString: CODEX_MODEL_MAP.gpt52Codex,
     provider: 'openai',
-    description: 'Latest frontier agentic coding model.',
+    description:
+      'Most advanced agentic coding model for complex software engineering (default for ChatGPT users).',
     contextWindow: CONTEXT_WINDOW_256K,
     maxOutputTokens: MAX_OUTPUT_32K,
     supportsVision: true,
@@ -32,38 +33,12 @@ export const CODEX_MODELS: ModelDefinition[] = [
     default: true,
     hasReasoning: true,
   },
-  {
-    id: CODEX_MODEL_MAP.gpt53CodexSpark,
-    name: 'GPT-5.3-Codex-Spark',
-    modelString: CODEX_MODEL_MAP.gpt53CodexSpark,
-    provider: 'openai',
-    description: 'Near-instant real-time coding model, 1000+ tokens/sec.',
-    contextWindow: CONTEXT_WINDOW_256K,
-    maxOutputTokens: MAX_OUTPUT_32K,
-    supportsVision: true,
-    supportsTools: true,
-    tier: 'premium' as const,
-    hasReasoning: true,
-  },
-  {
-    id: CODEX_MODEL_MAP.gpt52Codex,
-    name: 'GPT-5.2-Codex',
-    modelString: CODEX_MODEL_MAP.gpt52Codex,
-    provider: 'openai',
-    description: 'Frontier agentic coding model.',
-    contextWindow: CONTEXT_WINDOW_256K,
-    maxOutputTokens: MAX_OUTPUT_32K,
-    supportsVision: true,
-    supportsTools: true,
-    tier: 'premium' as const,
-    hasReasoning: true,
-  },
   {
     id: CODEX_MODEL_MAP.gpt51CodexMax,
     name: 'GPT-5.1-Codex-Max',
     modelString: CODEX_MODEL_MAP.gpt51CodexMax,
     provider: 'openai',
-    description: 'Codex-optimized flagship for deep and fast reasoning.',
+    description: 'Optimized for long-horizon, agentic coding tasks in Codex.',
     contextWindow: CONTEXT_WINDOW_256K,
     maxOutputTokens: MAX_OUTPUT_32K,
     supportsVision: true,
@@ -76,46 +51,7 @@ export const CODEX_MODELS: ModelDefinition[] = [
     name: 'GPT-5.1-Codex-Mini',
     modelString: CODEX_MODEL_MAP.gpt51CodexMini,
     provider: 'openai',
-    description: 'Optimized for codex. Cheaper, faster, but less capable.',
-    contextWindow: CONTEXT_WINDOW_128K,
-    maxOutputTokens: MAX_OUTPUT_16K,
-    supportsVision: true,
-    supportsTools: true,
-    tier: 'basic' as const,
-    hasReasoning: false,
-  },
-  {
-    id: CODEX_MODEL_MAP.gpt51Codex,
-    name: 'GPT-5.1-Codex',
-    modelString: CODEX_MODEL_MAP.gpt51Codex,
-    provider: 'openai',
-    description: 'Original GPT-5.1 Codex agentic coding model.',
-    contextWindow: CONTEXT_WINDOW_256K,
-    maxOutputTokens: MAX_OUTPUT_32K,
-    supportsVision: true,
-    supportsTools: true,
-    tier: 'standard' as const,
-    hasReasoning: true,
-  },
-  {
-    id: CODEX_MODEL_MAP.gpt5Codex,
-    name: 'GPT-5-Codex',
-    modelString: CODEX_MODEL_MAP.gpt5Codex,
-    provider: 'openai',
-    description: 'Original GPT-5 Codex model.',
-    contextWindow: CONTEXT_WINDOW_128K,
-    maxOutputTokens: MAX_OUTPUT_16K,
-    supportsVision: true,
-    supportsTools: true,
-    tier: 'standard' as const,
-    hasReasoning: true,
-  },
-  {
-    id: CODEX_MODEL_MAP.gpt5CodexMini,
-    name: 'GPT-5-Codex-Mini',
-    modelString: CODEX_MODEL_MAP.gpt5CodexMini,
-    provider: 'openai',
-    description: 'Smaller, cheaper GPT-5 Codex variant.',
+    description: 'Smaller, more cost-effective version for faster workflows.',
     contextWindow: CONTEXT_WINDOW_128K,
     maxOutputTokens: MAX_OUTPUT_16K,
     supportsVision: true,
@@ -130,7 +66,7 @@ export const CODEX_MODELS: ModelDefinition[] = [
     name: 'GPT-5.2',
     modelString: CODEX_MODEL_MAP.gpt52,
     provider: 'openai',
-    description: 'Latest frontier model with improvements across knowledge, reasoning and coding.',
+    description: 'Best general agentic model for tasks across industries and domains.',
     contextWindow: CONTEXT_WINDOW_256K,
     maxOutputTokens: MAX_OUTPUT_32K,
     supportsVision: true,
@@ -151,19 +87,6 @@ export const CODEX_MODELS: ModelDefinition[] = [
     tier: 'standard' as const,
     hasReasoning: true,
   },
-  {
-    id: CODEX_MODEL_MAP.gpt5,
-    name: 'GPT-5',
-    modelString: CODEX_MODEL_MAP.gpt5,
-    provider: 'openai',
-    description: 'Base GPT-5 model.',
-    contextWindow: CONTEXT_WINDOW_128K,
-    maxOutputTokens: MAX_OUTPUT_16K,
-    supportsVision: true,
-    supportsTools: true,
-    tier: 'standard' as const,
-    hasReasoning: true,
-  },
 ];
 
 /**

apps/server/src/providers/codex-provider.ts

@@ -30,9 +30,11 @@ import type {
   ModelDefinition,
 } from './types.js';
 import {
+  CODEX_MODEL_MAP,
   supportsReasoningEffort,
   validateBareModelId,
   calculateReasoningTimeout,
+  DEFAULT_TIMEOUT_MS,
   type CodexApprovalPolicy,
   type CodexSandboxMode,
   type CodexAuthStatus,
@@ -51,14 +53,18 @@ import { CODEX_MODELS } from './codex-models.js';
 
 const CODEX_COMMAND = 'codex';
 const CODEX_EXEC_SUBCOMMAND = 'exec';
-const CODEX_RESUME_SUBCOMMAND = 'resume';
 const CODEX_JSON_FLAG = '--json';
 const CODEX_MODEL_FLAG = '--model';
 const CODEX_VERSION_FLAG = '--version';
-const CODEX_CONFIG_FLAG = '--config';
-const CODEX_ADD_DIR_FLAG = '--add-dir';
+const CODEX_SANDBOX_FLAG = '--sandbox';
+const CODEX_APPROVAL_FLAG = '--ask-for-approval';
+const CODEX_SEARCH_FLAG = '--search';
 const CODEX_OUTPUT_SCHEMA_FLAG = '--output-schema';
+const CODEX_CONFIG_FLAG = '--config';
+const CODEX_IMAGE_FLAG = '--image';
+const CODEX_ADD_DIR_FLAG = '--add-dir';
 const CODEX_SKIP_GIT_REPO_CHECK_FLAG = '--skip-git-repo-check';
+const CODEX_RESUME_FLAG = 'resume';
 const CODEX_REASONING_EFFORT_KEY = 'reasoning_effort';
 const CODEX_YOLO_FLAG = '--dangerously-bypass-approvals-and-sandbox';
 const OPENAI_API_KEY_ENV = 'OPENAI_API_KEY';
@@ -98,8 +104,11 @@ const TEXT_ENCODING = 'utf-8';
  *
  * @see calculateReasoningTimeout from @automaker/types
  */
-const CODEX_CLI_TIMEOUT_MS = 120000; // 2 minutes — matches CLI provider base timeout
+const CODEX_CLI_TIMEOUT_MS = DEFAULT_TIMEOUT_MS;
 const CODEX_FEATURE_GENERATION_BASE_TIMEOUT_MS = 300000; // 5 minutes for feature generation
+const CONTEXT_WINDOW_256K = 256000;
+const MAX_OUTPUT_32K = 32000;
+const MAX_OUTPUT_16K = 16000;
 const SYSTEM_PROMPT_SEPARATOR = '\n\n';
 const CODEX_INSTRUCTIONS_DIR = '.codex';
 const CODEX_INSTRUCTIONS_SECTION = 'Codex Project Instructions';
@@ -127,16 +136,11 @@ const DEFAULT_ALLOWED_TOOLS = [
   'Read',
   'Write',
   'Edit',
-  'MultiEdit',
   'Glob',
   'Grep',
-  'LS',
   'Bash',
   'WebSearch',
   'WebFetch',
-  'TodoWrite',
-  'Task',
-  'Skill',
 ] as const;
 const SEARCH_TOOL_NAMES = new Set(['WebSearch', 'WebFetch']);
 const MIN_MAX_TURNS = 1;
@@ -206,42 +210,16 @@ function isSdkEligible(options: ExecuteOptions): boolean {
   return isNoToolsRequested(options) && !hasMcpServersConfigured(options);
 }
 
-function isSdkEligibleWithApiKey(options: ExecuteOptions): boolean {
-  // When using an API key (not CLI OAuth), prefer SDK over CLI to avoid OAuth issues.
-  // SDK mode is used when MCP servers are not configured (MCP requires CLI).
-  // Tool requests are handled by the SDK, so we allow SDK mode even with tools.
-  return !hasMcpServersConfigured(options);
-}
-
 async function resolveCodexExecutionPlan(options: ExecuteOptions): Promise<CodexExecutionPlan> {
   const cliPath = await findCodexCliPath();
   const authIndicators = await getCodexAuthIndicators();
   const openAiApiKey = await resolveOpenAiApiKey();
   const hasApiKey = Boolean(openAiApiKey);
-  const cliAvailable = Boolean(cliPath);
-  // CLI OAuth login takes priority: if the user has logged in via `codex login`,
-  // use the CLI regardless of whether an API key is also stored.
-  // hasOAuthToken = OAuth session from `codex login`
-  // authIndicators.hasApiKey = API key stored in Codex's own auth file (via `codex login --api-key`)
-  // Both are "CLI-native" auth — distinct from an API key stored in Automaker's credentials.
-  const hasCliNativeAuth = authIndicators.hasOAuthToken || authIndicators.hasApiKey;
+  const cliAuthenticated = authIndicators.hasOAuthToken || authIndicators.hasApiKey || hasApiKey;
   const sdkEligible = isSdkEligible(options);
+  const cliAvailable = Boolean(cliPath);
 
-  // If CLI is available and the user authenticated via the CLI (`codex login`),
-  // prefer CLI mode over SDK. This ensures `codex login` sessions take priority
-  // over API keys stored in Automaker's credentials.
-  if (cliAvailable && hasCliNativeAuth) {
-    return {
-      mode: CODEX_EXECUTION_MODE_CLI,
-      cliPath,
-      openAiApiKey,
-    };
-  }
-
-  // No CLI-native auth — prefer SDK when an API key is available.
-  // Using SDK with an API key avoids OAuth issues that can arise with the CLI.
-  // MCP servers still require CLI mode since the SDK doesn't support MCP.
-  if (hasApiKey && isSdkEligibleWithApiKey(options)) {
+  if (hasApiKey) {
     return {
       mode: CODEX_EXECUTION_MODE_SDK,
       cliPath,
@@ -249,16 +227,6 @@ async function resolveCodexExecutionPlan(options: ExecuteOptions): Promise<Codex
     };
   }
 
-  // MCP servers are requested with an API key but no CLI-native auth — use CLI mode
-  // with the API key passed as an environment variable.
-  if (hasApiKey && cliAvailable) {
-    return {
-      mode: CODEX_EXECUTION_MODE_CLI,
-      cliPath,
-      openAiApiKey,
-    };
-  }
-
   if (sdkEligible) {
     if (!cliAvailable) {
       throw new Error(ERROR_CODEX_SDK_AUTH_REQUIRED);
@@ -269,9 +237,15 @@ async function resolveCodexExecutionPlan(options: ExecuteOptions): Promise<Codex
     throw new Error(ERROR_CODEX_CLI_REQUIRED);
   }
 
-  // At this point, neither hasCliNativeAuth nor hasApiKey is true,
-  // so authentication is required regardless.
-  throw new Error(ERROR_CODEX_AUTH_REQUIRED);
+  if (!cliAuthenticated) {
+    throw new Error(ERROR_CODEX_AUTH_REQUIRED);
+  }
+
+  return {
+    mode: CODEX_EXECUTION_MODE_CLI,
+    cliPath,
+    openAiApiKey,
+  };
 }
 
 function getEventType(event: Record<string, unknown>): string | null {
@@ -361,14 +335,9 @@ function resolveSystemPrompt(systemPrompt?: unknown): string | null {
   return null;
 }
 
-function buildPromptText(options: ExecuteOptions): string {
-  return typeof options.prompt === 'string'
-    ? options.prompt
-    : extractTextFromContent(options.prompt);
-}
-
 function buildCombinedPrompt(options: ExecuteOptions, systemPromptText?: string | null): string {
-  const promptText = buildPromptText(options);
+  const promptText =
+    typeof options.prompt === 'string' ? options.prompt : extractTextFromContent(options.prompt);
   const historyText = options.conversationHistory
     ? formatHistoryAsText(options.conversationHistory)
     : '';
@@ -381,11 +350,6 @@ function buildCombinedPrompt(options: ExecuteOptions, systemPromptText?: string
   return `${historyText}${systemSection}${HISTORY_HEADER}${promptText}`;
 }
 
-function buildResumePrompt(options: ExecuteOptions): string {
-  const promptText = buildPromptText(options);
-  return `${HISTORY_HEADER}${promptText}`;
-}
-
 function formatConfigValue(value: string | number | boolean): string {
   return String(value);
 }
@@ -753,16 +717,6 @@ export class CodexProvider extends BaseProvider {
       );
       const baseSystemPrompt = resolveSystemPrompt(options.systemPrompt);
       const resolvedMaxTurns = resolveMaxTurns(options.maxTurns);
-      if (resolvedMaxTurns === null && options.maxTurns === undefined) {
-        logger.warn(
-          `[executeQuery] maxTurns not provided — Codex CLI will use its internal default. ` +
-            `This may cause premature completion. Model: ${options.model}`
-        );
-      } else {
-        logger.info(
-          `[executeQuery] maxTurns: requested=${options.maxTurns}, resolved=${resolvedMaxTurns}, model=${options.model}`
-        );
-      }
       const resolvedAllowedTools = options.allowedTools ?? Array.from(DEFAULT_ALLOWED_TOOLS);
       const restrictTools = !hasMcpServers || options.mcpUnrestrictedTools === false;
       const wantsOutputSchema = Boolean(
@@ -804,27 +758,24 @@ export class CodexProvider extends BaseProvider {
         options.cwd,
         codexSettings.sandboxMode !== 'danger-full-access'
       );
+      const resolvedSandboxMode = sandboxCheck.enabled
+        ? codexSettings.sandboxMode
+        : 'danger-full-access';
       if (!sandboxCheck.enabled && sandboxCheck.message) {
         console.warn(`[CodexProvider] ${sandboxCheck.message}`);
       }
       const searchEnabled =
         codexSettings.enableWebSearch || resolveSearchEnabled(resolvedAllowedTools, restrictTools);
-      const isResumeQuery = Boolean(options.sdkSessionId);
-      const schemaPath = isResumeQuery
-        ? null
-        : await writeOutputSchemaFile(options.cwd, options.outputFormat);
-      const imageBlocks =
-        !isResumeQuery && codexSettings.enableImages ? extractImageBlocks(options.prompt) : [];
-      const imagePaths = isResumeQuery ? [] : await writeImageFiles(options.cwd, imageBlocks);
+      const outputSchemaPath = await writeOutputSchemaFile(options.cwd, options.outputFormat);
+      const imageBlocks = codexSettings.enableImages ? extractImageBlocks(options.prompt) : [];
+      const imagePaths = await writeImageFiles(options.cwd, imageBlocks);
       const approvalPolicy =
         hasMcpServers && options.mcpAutoApproveTools !== undefined
           ? options.mcpAutoApproveTools
             ? 'never'
             : 'on-request'
           : codexSettings.approvalPolicy;
-      const promptText = isResumeQuery
-        ? buildResumePrompt(options)
-        : buildCombinedPrompt(options, combinedSystemPrompt);
+      const promptText = buildCombinedPrompt(options, combinedSystemPrompt);
       const commandPath = executionPlan.cliPath || CODEX_COMMAND;
 
       // Build config overrides for max turns and reasoning effort
@@ -850,43 +801,25 @@ export class CodexProvider extends BaseProvider {
         overrides.push({ key: 'features.web_search_request', value: true });
       }
 
-      const configOverrideArgs = buildConfigOverrides(overrides);
+      const configOverrides = buildConfigOverrides(overrides);
       const preExecArgs: string[] = [];
 
       // Add additional directories with write access
-      if (
-        !isResumeQuery &&
-        codexSettings.additionalDirs &&
-        codexSettings.additionalDirs.length > 0
-      ) {
+      if (codexSettings.additionalDirs && codexSettings.additionalDirs.length > 0) {
         for (const dir of codexSettings.additionalDirs) {
           preExecArgs.push(CODEX_ADD_DIR_FLAG, dir);
         }
       }
 
-      // If images were written to disk, add the image directory so the CLI can access them.
-      // Note: imagePaths is set to [] when isResumeQuery is true, so this check is sufficient.
-      if (imagePaths.length > 0) {
-        const imageDir = path.join(options.cwd, CODEX_INSTRUCTIONS_DIR, IMAGE_TEMP_DIR);
-        preExecArgs.push(CODEX_ADD_DIR_FLAG, imageDir);
-      }
-
       // Model is already bare (no prefix) - validated by executeQuery
-      const codexCommand = isResumeQuery
-        ? [CODEX_EXEC_SUBCOMMAND, CODEX_RESUME_SUBCOMMAND]
-        : [CODEX_EXEC_SUBCOMMAND];
-
       const args = [
-        ...codexCommand,
+        CODEX_EXEC_SUBCOMMAND,
         CODEX_YOLO_FLAG,
         CODEX_SKIP_GIT_REPO_CHECK_FLAG,
         ...preExecArgs,
         CODEX_MODEL_FLAG,
         options.model,
         CODEX_JSON_FLAG,
-        ...configOverrideArgs,
-        ...(schemaPath ? [CODEX_OUTPUT_SCHEMA_FLAG, schemaPath] : []),
-        ...(options.sdkSessionId ? [options.sdkSessionId] : []),
         '-', // Read prompt from stdin to avoid shell escaping issues
       ];
 
@@ -933,36 +866,16 @@ export class CodexProvider extends BaseProvider {
 
           // Enhance error message with helpful context
           let enhancedError = errorText;
-          const errorLower = errorText.toLowerCase();
-          if (errorLower.includes('rate limit')) {
+          if (errorText.toLowerCase().includes('rate limit')) {
             enhancedError = `${errorText}\n\nTip: You're being rate limited. Try reducing concurrent tasks or waiting a few minutes before retrying.`;
-          } else if (errorLower.includes('authentication') || errorLower.includes('unauthorized')) {
-            enhancedError = `${errorText}\n\nTip: Check that your OPENAI_API_KEY is set correctly or run 'codex login' to authenticate.`;
           } else if (
-            errorLower.includes('model does not exist') ||
-            errorLower.includes('requested model does not exist') ||
-            errorLower.includes('do not have access') ||
-            errorLower.includes('model_not_found') ||
-            errorLower.includes('invalid_model')
+            errorText.toLowerCase().includes('authentication') ||
+            errorText.toLowerCase().includes('unauthorized')
           ) {
-            enhancedError =
-              `${errorText}\n\nTip: The model '${options.model}' may not be available on your OpenAI plan. ` +
-              `See https://platform.openai.com/docs/models for available models. ` +
-              `Some models require a ChatGPT Pro/Plus subscription—authenticate with 'codex login' instead of an API key.`;
+            enhancedError = `${errorText}\n\nTip: Check that your OPENAI_API_KEY is set correctly or run 'codex auth login' to authenticate.`;
           } else if (
-            errorLower.includes('stream disconnected') ||
-            errorLower.includes('stream ended') ||
-            errorLower.includes('connection reset')
-          ) {
-            enhancedError =
-              `${errorText}\n\nTip: The connection to OpenAI was interrupted. This can happen due to:\n` +
-              `- Network instability\n` +
-              `- The model not being available on your plan\n` +
-              `- Server-side timeouts for long-running requests\n` +
-              `Try again, or switch to a different model.`;
-          } else if (
-            errorLower.includes('command not found') ||
-            errorLower.includes('is not recognized as an internal or external command')
+            errorText.toLowerCase().includes('not found') ||
+            errorText.toLowerCase().includes('command not found')
           ) {
             enhancedError = `${errorText}\n\nTip: Make sure the Codex CLI is installed. Run 'npm install -g @openai/codex-cli' to install.`;
           }
@@ -1120,6 +1033,7 @@ export class CodexProvider extends BaseProvider {
   async detectInstallation(): Promise<InstallationStatus> {
     const cliPath = await findCodexCliPath();
     const hasApiKey = Boolean(await resolveOpenAiApiKey());
+    const authIndicators = await getCodexAuthIndicators();
     const installed = !!cliPath;
 
     let version = '';
@@ -1131,7 +1045,7 @@ export class CodexProvider extends BaseProvider {
           cwd: process.cwd(),
         });
         version = result.stdout.trim();
-      } catch {
+      } catch (error) {
         version = '';
       }
     }

apps/server/src/providers/codex-sdk-client.ts

@@ -15,9 +15,6 @@ const SDK_HISTORY_HEADER = 'Current request:\n';
 const DEFAULT_RESPONSE_TEXT = '';
 const SDK_ERROR_DETAILS_LABEL = 'Details:';
 
-type SdkReasoningEffort = 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
-const SDK_REASONING_EFFORTS = new Set<string>(['minimal', 'low', 'medium', 'high', 'xhigh']);
-
 type PromptBlock = {
   type: string;
   text?: string;
@@ -102,52 +99,38 @@ export async function* executeCodexSdkQuery(
     const apiKey = resolveApiKey();
     const codex = new Codex({ apiKey });
 
-    // Build thread options with model
-    // The model must be passed to startThread/resumeThread so the SDK
-    // knows which model to use for the conversation. Without this,
-    // the SDK may use a default model that the user doesn't have access to.
-    const threadOptions: {
-      model?: string;
-      modelReasoningEffort?: SdkReasoningEffort;
-    } = {};
-
-    if (options.model) {
-      threadOptions.model = options.model;
-    }
-
-    // Add reasoning effort to thread options if model supports it
-    if (
-      options.reasoningEffort &&
-      options.model &&
-      supportsReasoningEffort(options.model) &&
-      options.reasoningEffort !== 'none' &&
-      SDK_REASONING_EFFORTS.has(options.reasoningEffort)
-    ) {
-      threadOptions.modelReasoningEffort = options.reasoningEffort as SdkReasoningEffort;
-    }
-
     // Resume existing thread or start new one
     let thread;
     if (options.sdkSessionId) {
       try {
-        thread = codex.resumeThread(options.sdkSessionId, threadOptions);
+        thread = codex.resumeThread(options.sdkSessionId);
       } catch {
         // If resume fails, start a new thread
-        thread = codex.startThread(threadOptions);
+        thread = codex.startThread();
       }
     } else {
-      thread = codex.startThread(threadOptions);
+      thread = codex.startThread();
     }
 
     const promptText = buildPromptText(options, systemPrompt);
 
-    // Build run options
+    // Build run options with reasoning effort if supported
     const runOptions: {
       signal?: AbortSignal;
+      reasoning?: { effort: string };
     } = {
       signal: options.abortController?.signal,
     };
 
+    // Add reasoning effort if model supports it and reasoningEffort is specified
+    if (
+      options.reasoningEffort &&
+      supportsReasoningEffort(options.model) &&
+      options.reasoningEffort !== 'none'
+    ) {
+      runOptions.reasoning = { effort: options.reasoningEffort };
+    }
+
     // Run the query
     const result = await thread.run(promptText, runOptions);
 
@@ -177,42 +160,10 @@ export async function* executeCodexSdkQuery(
   } catch (error) {
     const errorInfo = classifyError(error);
     const userMessage = getUserFriendlyErrorMessage(error);
-    let combinedMessage = buildSdkErrorMessage(errorInfo.message, userMessage);
-
-    // Enhance error messages with actionable tips for common Codex issues
-    // Normalize inputs to avoid crashes from nullish values
-    const errorLower = (errorInfo?.message ?? '').toLowerCase();
-    const modelLabel = options?.model ?? '<unknown model>';
-
-    if (
-      errorLower.includes('does not exist') ||
-      errorLower.includes('model_not_found') ||
-      errorLower.includes('invalid_model')
-    ) {
-      // Model not found - provide helpful guidance
-      combinedMessage +=
-        `\n\nTip: The model '${modelLabel}' may not be available on your OpenAI plan. ` +
-        `Some models (like gpt-5.3-codex) require a ChatGPT Pro/Plus subscription and OAuth login via 'codex login'. ` +
-        `Try using a different model (e.g., gpt-5.1 or gpt-5.2), or authenticate with 'codex login' instead of an API key.`;
-    } else if (
-      errorLower.includes('stream disconnected') ||
-      errorLower.includes('stream ended') ||
-      errorLower.includes('connection reset') ||
-      errorLower.includes('socket hang up')
-    ) {
-      // Stream disconnection - provide helpful guidance
-      combinedMessage +=
-        `\n\nTip: The connection to OpenAI was interrupted. This can happen due to:\n` +
-        `- Network instability\n` +
-        `- The model not being available on your plan (try 'codex login' for OAuth authentication)\n` +
-        `- Server-side timeouts for long-running requests\n` +
-        `Try again, or switch to a different model.`;
-    }
-
+    const combinedMessage = buildSdkErrorMessage(errorInfo.message, userMessage);
     console.error('[CodexSDK] executeQuery() error during execution:', {
       type: errorInfo.type,
       message: errorInfo.message,
-      model: options.model,
       isRateLimit: errorInfo.isRateLimit,
       retryAfter: errorInfo.retryAfter,
       stack: error instanceof Error ? error.stack : undefined,

apps/server/src/providers/copilot-provider.ts

@@ -30,7 +30,6 @@ import {
   type CopilotRuntimeModel,
 } from '@automaker/types';
 import { createLogger, isAbortError } from '@automaker/utils';
-import { resolveModelString } from '@automaker/model-resolver';
 import { CopilotClient, type PermissionRequest } from '@github/copilot-sdk';
 import {
   normalizeTodos,
@@ -43,7 +42,7 @@ import {
 const logger = createLogger('CopilotProvider');
 
 // Default bare model (without copilot- prefix) for SDK calls
-const DEFAULT_BARE_MODEL = 'claude-sonnet-4.6';
+const DEFAULT_BARE_MODEL = 'claude-sonnet-4.5';
 
 // =============================================================================
 // SDK Event Types (from @github/copilot-sdk)
@@ -86,6 +85,10 @@ interface SdkToolExecutionEndEvent extends SdkEvent {
   };
 }
 
+interface SdkSessionIdleEvent extends SdkEvent {
+  type: 'session.idle';
+}
+
 interface SdkSessionErrorEvent extends SdkEvent {
   type: 'session.error';
   data: {
@@ -117,12 +120,6 @@ export interface CopilotError extends Error {
   suggestion?: string;
 }
 
-type CopilotSession = Awaited<ReturnType<CopilotClient['createSession']>>;
-type CopilotSessionOptions = Parameters<CopilotClient['createSession']>[0];
-type ResumableCopilotClient = CopilotClient & {
-  resumeSession?: (sessionId: string, options: CopilotSessionOptions) => Promise<CopilotSession>;
-};
-
 // =============================================================================
 // Tool Name Normalization
 // =============================================================================
@@ -389,14 +386,9 @@ export class CopilotProvider extends CliProvider {
 
       case 'session.error': {
         const errorEvent = sdkEvent as SdkSessionErrorEvent;
-        const enrichedError =
-          errorEvent.data.message ||
-          (errorEvent.data.code
-            ? `Copilot agent error (code: ${errorEvent.data.code})`
-            : 'Copilot agent error');
         return {
           type: 'error',
-          error: enrichedError,
+          error: errorEvent.data.message || 'Unknown error',
         };
       }
 
@@ -528,11 +520,7 @@ export class CopilotProvider extends CliProvider {
     }
 
     const promptText = this.extractPromptText(options);
-    // resolveModelString may return dash-separated canonical names (e.g. "claude-sonnet-4-6"),
-    // but the Copilot SDK expects dot-separated version suffixes (e.g. "claude-sonnet-4.6").
-    // Normalize by converting the last dash-separated numeric pair to dot notation.
-    const resolvedModel = resolveModelString(options.model || DEFAULT_BARE_MODEL);
-    const bareModel = resolvedModel.replace(/-(\d+)-(\d+)$/, '-$1.$2');
+    const bareModel = options.model || DEFAULT_BARE_MODEL;
     const workingDirectory = options.cwd || process.cwd();
 
     logger.debug(
@@ -570,14 +558,12 @@ export class CopilotProvider extends CliProvider {
       });
     };
 
-    // Declare session outside try so it's accessible in the catch block for cleanup.
-    let session: CopilotSession | undefined;
-
     try {
       await client.start();
       logger.debug(`CopilotClient started with cwd: ${workingDirectory}`);
 
-      const sessionOptions: CopilotSessionOptions = {
+      // Create session with streaming enabled for real-time events
+      const session = await client.createSession({
         model: bareModel,
         streaming: true,
         // AUTONOMOUS MODE: Auto-approve all permission requests.
@@ -590,33 +576,13 @@ export class CopilotProvider extends CliProvider {
           logger.debug(`Permission request: ${request.kind}`);
           return { kind: 'approved' };
         },
-      };
+      });
 
-      // Resume the previous Copilot session when possible; otherwise create a fresh one.
-      const resumableClient = client as ResumableCopilotClient;
-      let sessionResumed = false;
-      if (options.sdkSessionId && typeof resumableClient.resumeSession === 'function') {
-        try {
-          session = await resumableClient.resumeSession(options.sdkSessionId, sessionOptions);
-          sessionResumed = true;
-          logger.debug(`Resumed Copilot session: ${session.sessionId}`);
-        } catch (resumeError) {
-          logger.warn(
-            `Failed to resume Copilot session "${options.sdkSessionId}", creating a new session: ${resumeError}`
-          );
-          session = await client.createSession(sessionOptions);
-        }
-      } else {
-        session = await client.createSession(sessionOptions);
-      }
-
-      // session is always assigned by this point (both branches above assign it)
-      const activeSession = session!;
-      const sessionId = activeSession.sessionId;
-      logger.debug(`Session ${sessionResumed ? 'resumed' : 'created'}: ${sessionId}`);
+      const sessionId = session.sessionId;
+      logger.debug(`Session created: ${sessionId}`);
 
       // Set up event handler to push events to queue
-      activeSession.on((event: SdkEvent) => {
+      session.on((event: SdkEvent) => {
         logger.debug(`SDK event: ${event.type}`);
 
         if (event.type === 'session.idle') {
@@ -634,7 +600,7 @@ export class CopilotProvider extends CliProvider {
       });
 
       // Send the prompt (non-blocking)
-      await activeSession.send({ prompt: promptText });
+      await session.send({ prompt: promptText });
 
       // Process events as they arrive
       while (!sessionComplete || eventQueue.length > 0) {
@@ -642,7 +608,7 @@ export class CopilotProvider extends CliProvider {
 
         // Check for errors first (before processing events to avoid race condition)
         if (sessionError) {
-          await activeSession.destroy();
+          await session.destroy();
           await client.stop();
           throw sessionError;
         }
@@ -662,19 +628,11 @@ export class CopilotProvider extends CliProvider {
       }
 
       // Cleanup
-      await activeSession.destroy();
+      await session.destroy();
       await client.stop();
       logger.debug('CopilotClient stopped successfully');
     } catch (error) {
-      // Ensure session is destroyed and client is stopped on error to prevent leaks.
-      // The session may have been created/resumed before the error occurred.
-      if (session) {
-        try {
-          await session.destroy();
-        } catch (sessionCleanupError) {
-          logger.debug(`Failed to destroy session during cleanup: ${sessionCleanupError}`);
-        }
-      }
+      // Ensure client is stopped on error
       try {
         await client.stop();
       } catch (cleanupError) {

apps/server/src/providers/cursor-provider.ts

@@ -14,7 +14,6 @@ import { execSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { findCliInWsl, isWslAvailable } from '@automaker/platform';
 import {
   CliProvider,
   type CliSpawnConfig,
@@ -31,7 +30,7 @@ import type {
 } from './types.js';
 import { validateBareModelId } from '@automaker/types';
 import { validateApiKey } from '../lib/auth-utils.js';
-import { getEffectivePermissions, detectProfile } from '../services/cursor-config-service.js';
+import { getEffectivePermissions } from '../services/cursor-config-service.js';
 import {
   type CursorStreamEvent,
   type CursorSystemEvent,
@@ -69,7 +68,6 @@ interface CursorToolHandler<TArgs = unknown, TResult = unknown> {
  * Registry of Cursor tool handlers
  * Each handler knows how to normalize its specific tool call type
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- handler registry stores heterogeneous tool type parameters
 const CURSOR_TOOL_HANDLERS: Record<string, CursorToolHandler<any, any>> = {
   readToolCall: {
     name: 'Read',
@@ -288,113 +286,15 @@ export class CursorProvider extends CliProvider {
 
   getSpawnConfig(): CliSpawnConfig {
     return {
-      windowsStrategy: 'direct',
+      windowsStrategy: 'wsl', // cursor-agent requires WSL on Windows
       commonPaths: {
         linux: [
           path.join(os.homedir(), '.local/bin/cursor-agent'), // Primary symlink location
           '/usr/local/bin/cursor-agent',
         ],
         darwin: [path.join(os.homedir(), '.local/bin/cursor-agent'), '/usr/local/bin/cursor-agent'],
-        win32: [
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'Cursor',
-            'resources',
-            'app',
-            'bin',
-            'cursor-agent.exe'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'Cursor',
-            'resources',
-            'app',
-            'bin',
-            'cursor-agent.cmd'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'Cursor',
-            'resources',
-            'app',
-            'bin',
-            'cursor.exe'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'Cursor',
-            'cursor.exe'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'cursor',
-            'resources',
-            'app',
-            'bin',
-            'cursor-agent.exe'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'cursor',
-            'resources',
-            'app',
-            'bin',
-            'cursor-agent.cmd'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'cursor',
-            'resources',
-            'app',
-            'bin',
-            'cursor.exe'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'Programs',
-            'cursor',
-            'cursor.exe'
-          ),
-          path.join(
-            process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),
-            'npm',
-            'cursor-agent.cmd'
-          ),
-          path.join(
-            process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),
-            'npm',
-            'cursor.cmd'
-          ),
-          path.join(
-            process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),
-            '.npm-global',
-            'bin',
-            'cursor-agent.cmd'
-          ),
-          path.join(
-            process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),
-            '.npm-global',
-            'bin',
-            'cursor.cmd'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'pnpm',
-            'cursor-agent.cmd'
-          ),
-          path.join(
-            process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'),
-            'pnpm',
-            'cursor.cmd'
-          ),
-        ],
+        // Windows paths are not used - we check for WSL installation instead
+        win32: [],
       },
     };
   }
@@ -450,11 +350,6 @@ export class CursorProvider extends CliProvider {
       cliArgs.push('--model', model);
     }
 
-    // Resume an existing chat when a provider session ID is available
-    if (options.sdkSessionId) {
-      cliArgs.push('--resume', options.sdkSessionId);
-    }
-
     // Use '-' to indicate reading prompt from stdin
     cliArgs.push('-');
 
@@ -562,14 +457,10 @@ export class CursorProvider extends CliProvider {
         const resultEvent = cursorEvent as CursorResultEvent;
 
         if (resultEvent.is_error) {
-          const errorText = resultEvent.error || resultEvent.result || '';
-          const enrichedError =
-            errorText ||
-            `Cursor agent failed (duration: ${resultEvent.duration_ms}ms, subtype: ${resultEvent.subtype}, session: ${resultEvent.session_id ?? 'none'})`;
           return {
             type: 'error',
             session_id: resultEvent.session_id,
-            error: enrichedError,
+            error: resultEvent.error || resultEvent.result || 'Unknown error',
           };
         }
 
@@ -596,92 +487,6 @@ export class CursorProvider extends CliProvider {
    * 2. Cursor IDE with 'cursor agent' subcommand support
    */
   protected detectCli(): CliDetectionResult {
-    if (process.platform === 'win32') {
-      const findInPath = (command: string): string | null => {
-        try {
-          const result = execSync(`where ${command}`, {
-            encoding: 'utf8',
-            timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-            windowsHide: true,
-          })
-            .trim()
-            .split(/\r?\n/)[0];
-
-          if (result && fs.existsSync(result)) {
-            return result;
-          }
-        } catch {
-          // Not in PATH
-        }
-
-        return null;
-      };
-
-      const isCursorAgentBinary = (cliPath: string) =>
-        cliPath.toLowerCase().includes('cursor-agent');
-
-      const supportsCursorAgentSubcommand = (cliPath: string) => {
-        try {
-          execSync(`"${cliPath}" agent --version`, {
-            encoding: 'utf8',
-            timeout: 5000,
-            stdio: 'pipe',
-            windowsHide: true,
-          });
-          return true;
-        } catch {
-          return false;
-        }
-      };
-
-      const pathResult = findInPath('cursor-agent') || findInPath('cursor');
-      if (pathResult) {
-        if (isCursorAgentBinary(pathResult) || supportsCursorAgentSubcommand(pathResult)) {
-          return {
-            cliPath: pathResult,
-            useWsl: false,
-            strategy: pathResult.toLowerCase().endsWith('.cmd') ? 'cmd' : 'direct',
-          };
-        }
-      }
-
-      const config = this.getSpawnConfig();
-      for (const candidate of config.commonPaths.win32 || []) {
-        const resolved = candidate;
-        if (!fs.existsSync(resolved)) {
-          continue;
-        }
-        if (isCursorAgentBinary(resolved) || supportsCursorAgentSubcommand(resolved)) {
-          return {
-            cliPath: resolved,
-            useWsl: false,
-            strategy: resolved.toLowerCase().endsWith('.cmd') ? 'cmd' : 'direct',
-          };
-        }
-      }
-
-      const wslLogger = (msg: string) => logger.debug(msg);
-      if (isWslAvailable({ logger: wslLogger })) {
-        const wslResult = findCliInWsl('cursor-agent', { logger: wslLogger });
-        if (wslResult) {
-          logger.debug(
-            `Using cursor-agent via WSL (${wslResult.distribution || 'default'}): ${wslResult.wslPath}`
-          );
-          return {
-            cliPath: 'wsl.exe',
-            useWsl: true,
-            wslCliPath: wslResult.wslPath,
-            wslDistribution: wslResult.distribution,
-            strategy: 'wsl',
-          };
-        }
-      }
-
-      logger.debug('cursor-agent not found on Windows');
-      return { cliPath: null, useWsl: false, strategy: 'direct' };
-    }
-
     // First try standard detection (PATH, common paths, WSL)
     const result = super.detectCli();
     if (result.cliPath) {
@@ -690,7 +495,7 @@ export class CursorProvider extends CliProvider {
 
     // Cursor-specific: Check versions directory for any installed version
     // This handles cases where cursor-agent is installed but not in PATH
-    if (fs.existsSync(CursorProvider.VERSIONS_DIR)) {
+    if (process.platform !== 'win32' && fs.existsSync(CursorProvider.VERSIONS_DIR)) {
       try {
         const versions = fs
           .readdirSync(CursorProvider.VERSIONS_DIR)
@@ -716,31 +521,33 @@ export class CursorProvider extends CliProvider {
 
     // If cursor-agent not found, try to find 'cursor' IDE and use 'cursor agent' subcommand
     // The Cursor IDE includes the agent as a subcommand: cursor agent
-    const cursorPaths = [
-      '/usr/bin/cursor',
-      '/usr/local/bin/cursor',
-      path.join(os.homedir(), '.local/bin/cursor'),
-      '/opt/cursor/cursor',
-    ];
+    if (process.platform !== 'win32') {
+      const cursorPaths = [
+        '/usr/bin/cursor',
+        '/usr/local/bin/cursor',
+        path.join(os.homedir(), '.local/bin/cursor'),
+        '/opt/cursor/cursor',
+      ];
 
-    for (const cursorPath of cursorPaths) {
-      if (fs.existsSync(cursorPath)) {
-        // Verify cursor agent subcommand works
-        try {
-          execSync(`"${cursorPath}" agent --version`, {
-            encoding: 'utf8',
-            timeout: 5000,
-            stdio: 'pipe',
-          });
-          logger.debug(`Using cursor agent via Cursor IDE: ${cursorPath}`);
-          // Return cursor path but we'll use 'cursor agent' subcommand
-          return {
-            cliPath: cursorPath,
-            useWsl: false,
-            strategy: 'native',
-          };
-        } catch {
-          // cursor agent subcommand doesn't work, try next path
+      for (const cursorPath of cursorPaths) {
+        if (fs.existsSync(cursorPath)) {
+          // Verify cursor agent subcommand works
+          try {
+            execSync(`"${cursorPath}" agent --version`, {
+              encoding: 'utf8',
+              timeout: 5000,
+              stdio: 'pipe',
+            });
+            logger.debug(`Using cursor agent via Cursor IDE: ${cursorPath}`);
+            // Return cursor path but we'll use 'cursor agent' subcommand
+            return {
+              cliPath: cursorPath,
+              useWsl: false,
+              strategy: 'native',
+            };
+          } catch {
+            // cursor agent subcommand doesn't work, try next path
+          }
         }
       }
     }
@@ -887,12 +694,8 @@ export class CursorProvider extends CliProvider {
 
     logger.debug(`CursorProvider.executeQuery called with model: "${options.model}"`);
 
-    // Get effective permissions for this project and detect the active profile
+    // Get effective permissions for this project
     const effectivePermissions = await getEffectivePermissions(options.cwd || process.cwd());
-    const activeProfile = detectProfile(effectivePermissions);
-    logger.debug(
-      `Active permission profile: ${activeProfile ?? 'none'}, permissions: ${JSON.stringify(effectivePermissions)}`
-    );
 
     // Debug: log raw events when AUTOMAKER_DEBUG_RAW_OUTPUT is enabled
     const debugRawEvents =

apps/server/src/providers/gemini-provider.ts

@@ -20,11 +20,12 @@ import type {
   ProviderMessage,
   InstallationStatus,
   ModelDefinition,
+  ContentBlock,
 } from './types.js';
 import { validateBareModelId } from '@automaker/types';
 import { GEMINI_MODEL_MAP, type GeminiAuthStatus } from '@automaker/types';
 import { createLogger, isAbortError } from '@automaker/utils';
-import { spawnJSONLProcess, type SubprocessOptions } from '@automaker/platform';
+import { spawnJSONLProcess } from '@automaker/platform';
 import { normalizeTodos } from './tool-normalization.js';
 
 // Create logger for this module
@@ -263,14 +264,6 @@ export class GeminiProvider extends CliProvider {
     // Use explicit approval-mode for clearer semantics
     cliArgs.push('--approval-mode', 'yolo');
 
-    // Force headless (non-interactive) mode with --prompt flag.
-    // The actual prompt content is passed via stdin (see buildSubprocessOptions()),
-    // but we MUST include -p to trigger headless mode. Without it, Gemini CLI
-    // starts in interactive mode which adds significant startup overhead
-    // (interactive REPL setup, extra context loading, etc.).
-    // Per Gemini CLI docs: stdin content is "appended to" the -p value.
-    cliArgs.push('--prompt', '');
-
     // Explicitly include the working directory in allowed workspace directories
     // This ensures Gemini CLI allows file operations in the project directory,
     // even if it has a different workspace cached from a previous session
@@ -278,15 +271,13 @@ export class GeminiProvider extends CliProvider {
       cliArgs.push('--include-directories', options.cwd);
     }
 
-    // Resume an existing Gemini session when one is available
-    if (options.sdkSessionId) {
-      cliArgs.push('--resume', options.sdkSessionId);
-    }
-
     // Note: Gemini CLI doesn't have a --thinking-level flag.
     // Thinking capabilities are determined by the model selection (e.g., gemini-2.5-pro).
     // The model handles thinking internally based on the task complexity.
 
+    // The prompt will be passed as the last positional argument
+    // We'll append it in executeQuery after extracting the text
+
     return cliArgs;
   }
 
@@ -381,13 +372,10 @@ export class GeminiProvider extends CliProvider {
         const resultEvent = geminiEvent as GeminiResultEvent;
 
         if (resultEvent.status === 'error') {
-          const enrichedError =
-            resultEvent.error ||
-            `Gemini agent failed (duration: ${resultEvent.stats?.duration_ms ?? 'unknown'}ms, session: ${resultEvent.session_id ?? 'none'})`;
           return {
             type: 'error',
             session_id: resultEvent.session_id,
-            error: enrichedError,
+            error: resultEvent.error || 'Unknown error',
           };
         }
 
@@ -404,12 +392,10 @@ export class GeminiProvider extends CliProvider {
 
       case 'error': {
         const errorEvent = geminiEvent as GeminiResultEvent;
-        const enrichedError =
-          errorEvent.error || `Gemini agent failed (session: ${errorEvent.session_id ?? 'none'})`;
         return {
           type: 'error',
           session_id: errorEvent.session_id,
-          error: enrichedError,
+          error: errorEvent.error || 'Unknown error',
         };
       }
 
@@ -423,32 +409,6 @@ export class GeminiProvider extends CliProvider {
   // CliProvider Overrides
   // ==========================================================================
 
-  /**
-   * Build subprocess options with stdin data for prompt and speed-optimized env vars.
-   *
-   * Passes the prompt via stdin instead of --prompt CLI arg to:
-   * - Avoid shell argument size limits with large prompts (system prompt + context)
-   * - Avoid shell escaping issues with special characters in prompts
-   * - Match the pattern used by Cursor, OpenCode, and Codex providers
-   *
-   * Also injects environment variables to reduce Gemini CLI startup overhead:
-   * - GEMINI_TELEMETRY_ENABLED=false: Disables OpenTelemetry collection
-   */
-  protected buildSubprocessOptions(options: ExecuteOptions, cliArgs: string[]): SubprocessOptions {
-    const subprocessOptions = super.buildSubprocessOptions(options, cliArgs);
-
-    // Pass prompt via stdin to avoid shell interpretation of special characters
-    // and shell argument size limits with large system prompts + context files
-    subprocessOptions.stdinData = this.extractPromptText(options);
-
-    // Disable telemetry to reduce startup overhead
-    if (subprocessOptions.env) {
-      subprocessOptions.env['GEMINI_TELEMETRY_ENABLED'] = 'false';
-    }
-
-    return subprocessOptions;
-  }
-
   /**
    * Override error mapping for Gemini-specific error codes
    */
@@ -558,21 +518,14 @@ export class GeminiProvider extends CliProvider {
       );
     }
 
-    // Ensure .geminiignore exists in the working directory to prevent Gemini CLI
-    // from scanning .git and node_modules directories during startup. This reduces
-    // startup time significantly (reported: 35s → 11s) by skipping large directories
-    // that Gemini CLI would otherwise traverse for context discovery.
-    await this.ensureGeminiIgnore(options.cwd || process.cwd());
+    // Extract prompt text to pass as positional argument
+    const promptText = this.extractPromptText(options);
 
-    // Embed system prompt into the user prompt so Gemini CLI receives
-    // project context (CLAUDE.md, CODE_QUALITY.md, etc.) that would
-    // otherwise be silently dropped since Gemini CLI has no --system-prompt flag.
-    const effectiveOptions = this.embedSystemPromptIntoPrompt(options);
+    // Build CLI args and append the prompt as the last positional argument
+    const cliArgs = this.buildCliArgs(options);
+    cliArgs.push(promptText); // Gemini CLI uses positional args for the prompt
 
-    // Build CLI args for headless execution.
-    const cliArgs = this.buildCliArgs(effectiveOptions);
-
-    const subprocessOptions = this.buildSubprocessOptions(effectiveOptions, cliArgs);
+    const subprocessOptions = this.buildSubprocessOptions(options, cliArgs);
 
     let sessionId: string | undefined;
 
@@ -625,49 +578,6 @@ export class GeminiProvider extends CliProvider {
   // Gemini-Specific Methods
   // ==========================================================================
 
-  /**
-   * Ensure a .geminiignore file exists in the working directory.
-   *
-   * Gemini CLI scans the working directory for context discovery during startup.
-   * Excluding .git and node_modules dramatically reduces startup time by preventing
-   * traversal of large directories (reported improvement: 35s → 11s).
-   *
-   * Only creates the file if it doesn't already exist to avoid overwriting user config.
-   */
-  private async ensureGeminiIgnore(cwd: string): Promise<void> {
-    const ignorePath = path.join(cwd, '.geminiignore');
-    const content = [
-      '# Auto-generated by Automaker to speed up Gemini CLI startup',
-      '# Prevents Gemini CLI from scanning large directories during context discovery',
-      '.git',
-      'node_modules',
-      'dist',
-      'build',
-      '.next',
-      '.nuxt',
-      'coverage',
-      '.automaker',
-      '.worktrees',
-      '.vscode',
-      '.idea',
-      '*.lock',
-      '',
-    ].join('\n');
-    try {
-      // Use 'wx' flag for atomic creation - fails if file exists (EEXIST)
-      await fs.writeFile(ignorePath, content, { encoding: 'utf-8', flag: 'wx' });
-      logger.debug(`Created .geminiignore at ${ignorePath}`);
-    } catch (writeError) {
-      // EEXIST means file already exists - that's fine, preserve user's file
-      if ((writeError as NodeJS.ErrnoException).code === 'EEXIST') {
-        logger.debug(`.geminiignore already exists at ${ignorePath}, preserving existing file`);
-        return;
-      }
-      // Non-fatal: startup will just be slower without the ignore file
-      logger.debug(`Failed to create .geminiignore: ${writeError}`);
-    }
-  }
-
   /**
    * Create a GeminiError with details
    */

apps/server/src/providers/opencode-provider.ts

@@ -192,28 +192,6 @@ export interface OpenCodeToolErrorEvent extends OpenCodeBaseEvent {
   part?: OpenCodePart & { error: string };
 }
 
-/**
- * Tool use event - The actual format emitted by OpenCode CLI when a tool is invoked.
- * Contains the tool name, call ID, and the complete state (input, output, status).
- * Note: OpenCode CLI emits 'tool_use' (not 'tool_call') as the event type.
- */
-export interface OpenCodeToolUseEvent extends OpenCodeBaseEvent {
-  type: 'tool_use';
-  part: OpenCodePart & {
-    type: 'tool';
-    callID?: string;
-    tool?: string;
-    state?: {
-      status?: string;
-      input?: unknown;
-      output?: string;
-      title?: string;
-      metadata?: unknown;
-      time?: { start: number; end: number };
-    };
-  };
-}
-
 /**
  * Union type of all OpenCode stream events
  */
@@ -222,7 +200,6 @@ export type OpenCodeStreamEvent =
   | OpenCodeStepStartEvent
   | OpenCodeStepFinishEvent
   | OpenCodeToolCallEvent
-  | OpenCodeToolUseEvent
   | OpenCodeToolResultEvent
   | OpenCodeErrorEvent
   | OpenCodeToolErrorEvent;
@@ -334,8 +311,8 @@ export class OpencodeProvider extends CliProvider {
    * Arguments built:
    * - 'run' subcommand for executing queries
    * - '--format', 'json' for JSONL streaming output
+   * - '-c', '<cwd>' for working directory (using opencode's -c flag)
    * - '--model', '<model>' for model selection (if specified)
-   * - '--session', '<id>' for continuing an existing session (if sdkSessionId is set)
    *
    * The prompt is passed via stdin (piped) to avoid shell escaping issues.
    * OpenCode CLI automatically reads from stdin when input is piped.
@@ -349,14 +326,6 @@ export class OpencodeProvider extends CliProvider {
     // Add JSON output format for JSONL parsing (not 'stream-json')
     args.push('--format', 'json');
 
-    // Handle session resumption for conversation continuity.
-    // The opencode CLI supports `--session <id>` to continue an existing session.
-    // The sdkSessionId is captured from the sessionID field in previous stream events
-    // and persisted by AgentService for use in follow-up messages.
-    if (options.sdkSessionId) {
-      args.push('--session', options.sdkSessionId);
-    }
-
     // Handle model selection
     // Convert canonical prefix format (opencode-xxx) to CLI slash format (opencode/xxx)
     // OpenCode CLI expects provider/model format (e.g., 'opencode/big-model')
@@ -429,225 +398,15 @@ export class OpencodeProvider extends CliProvider {
     return subprocessOptions;
   }
 
-  /**
-   * Check if an error message indicates a session-not-found condition.
-   *
-   * Centralizes the pattern matching for session errors to avoid duplication.
-   * Strips ANSI escape codes first since opencode CLI uses colored stderr output
-   * (e.g. "\x1b[91m\x1b[1mError: \x1b[0mSession not found").
-   *
-   * IMPORTANT: Patterns must be specific enough to avoid false positives.
-   * Generic patterns like "notfounderror" or "resource not found" match
-   * non-session errors (e.g. "ProviderModelNotFoundError") which would
-   * trigger unnecessary retries that fail identically, producing confusing
-   * error messages like "OpenCode session could not be created".
-   *
-   * @param errorText - Raw error text (may contain ANSI codes)
-   * @returns true if the error indicates the session was not found
-   */
-  private static isSessionNotFoundError(errorText: string): boolean {
-    const cleaned = OpencodeProvider.stripAnsiCodes(errorText).toLowerCase();
-
-    // Explicit session-related phrases — high confidence
-    if (
-      cleaned.includes('session not found') ||
-      cleaned.includes('session does not exist') ||
-      cleaned.includes('invalid session') ||
-      cleaned.includes('session expired') ||
-      cleaned.includes('no such session')
-    ) {
-      return true;
-    }
-
-    // Generic "NotFoundError" / "resource not found" are only session errors
-    // when the message also references a session path or session ID.
-    // Without this guard, errors like "ProviderModelNotFoundError" or
-    // "Resource not found: /path/to/config.json" would false-positive.
-    if (cleaned.includes('notfounderror') || cleaned.includes('resource not found')) {
-      return cleaned.includes('/session/') || /\bsession\b/.test(cleaned);
-    }
-
-    return false;
-  }
-
-  /**
-   * Strip ANSI escape codes from a string.
-   *
-   * The OpenCode CLI uses colored stderr output (e.g. "\x1b[91m\x1b[1mError: \x1b[0m").
-   * These escape codes render as garbled text like "[91m[1mError: [0m" in the UI
-   * when passed through as-is. This utility removes them so error messages are
-   * clean and human-readable.
-   */
-  private static stripAnsiCodes(text: string): string {
-    return text.replace(/\x1b\[[0-9;]*m/g, '');
-  }
-
-  /**
-   * Clean a CLI error message for display.
-   *
-   * Strips ANSI escape codes AND removes the redundant "Error: " prefix that
-   * the OpenCode CLI prepends to error messages in its colored stderr output
-   * (e.g. "\x1b[91m\x1b[1mError: \x1b[0mSession not found" → "Session not found").
-   *
-   * Without this, consumers that wrap the message in their own "Error: " prefix
-   * (like AgentService or AgentExecutor) produce garbled double-prefixed output:
-   * "Error: Error: Session not found".
-   */
-  private static cleanErrorMessage(text: string): string {
-    let cleaned = OpencodeProvider.stripAnsiCodes(text).trim();
-    // Remove leading "Error: " prefix (case-insensitive) if present.
-    // The CLI formats errors as: \x1b[91m\x1b[1mError: \x1b[0m<actual message>
-    // After ANSI stripping this becomes: "Error: <actual message>"
-    cleaned = cleaned.replace(/^Error:\s*/i, '').trim();
-    return cleaned || text;
-  }
-
-  /**
-   * Execute a query with automatic session resumption fallback.
-   *
-   * When a sdkSessionId is provided, the CLI receives `--session <id>`.
-   * If the session no longer exists on disk the CLI will fail with a
-   * "NotFoundError" / "Resource not found" / "Session not found" error.
-   *
-   * The opencode CLI writes this to **stderr** and exits non-zero.
-   * `spawnJSONLProcess` collects stderr and **yields** it as
-   * `{ type: 'error', error: <stderrText> }` — it is NOT thrown.
-   * After `normalizeEvent`, the error becomes a yielded `ProviderMessage`
-   * with `type: 'error'`.  A simple try/catch therefore cannot intercept it.
-   *
-   * This override iterates the parent stream, intercepts yielded error
-   * messages that match the session-not-found pattern, and retries the
-   * entire query WITHOUT the `--session` flag so a fresh session is started.
-   *
-   * Session-not-found retry is ONLY attempted when `sdkSessionId` is set.
-   * Without the `--session` flag the CLI always creates a fresh session, so
-   * retrying without it would be identical to the first attempt and would
-   * fail the same way — producing a confusing "session could not be created"
-   * message for what is actually a different error (model not found, auth
-   * failure, etc.).
-   *
-   * All error messages (session or not) are cleaned of ANSI codes and the
-   * CLI's redundant "Error: " prefix before being yielded to consumers.
-   *
-   * After a successful retry, the consumer (AgentService) will receive a new
-   * session_id from the fresh stream events, which it persists to metadata —
-   * replacing the stale sdkSessionId and preventing repeated failures.
-   */
-  async *executeQuery(options: ExecuteOptions): AsyncGenerator<ProviderMessage> {
-    // When no sdkSessionId is set, there is nothing to "retry without" — just
-    // stream normally and clean error messages as they pass through.
-    if (!options.sdkSessionId) {
-      for await (const msg of super.executeQuery(options)) {
-        // Clean error messages so consumers don't get ANSI or double "Error:" prefix
-        if (msg.type === 'error' && msg.error && typeof msg.error === 'string') {
-          msg.error = OpencodeProvider.cleanErrorMessage(msg.error);
-        }
-        yield msg;
-      }
-      return;
-    }
-
-    // sdkSessionId IS set — the CLI will receive `--session <id>`.
-    // If that session no longer exists, intercept the error and retry fresh.
-    //
-    // To avoid buffering the entire stream in memory for long-lived sessions,
-    // we only buffer an initial window of messages until we observe a healthy
-    // (non-error) message. Once a healthy message is seen, we flush the buffer
-    // and switch to direct passthrough, while still watching for session errors
-    // via isSessionNotFoundError on any subsequent error messages.
-    const buffered: ProviderMessage[] = [];
-    let sessionError = false;
-    let seenHealthyMessage = false;
-
-    try {
-      for await (const msg of super.executeQuery(options)) {
-        if (msg.type === 'error') {
-          const errorText = msg.error || '';
-          if (OpencodeProvider.isSessionNotFoundError(errorText)) {
-            sessionError = true;
-            opencodeLogger.info(
-              `OpenCode session error detected (session "${options.sdkSessionId}") ` +
-                `— retrying without --session to start fresh`
-            );
-            break; // stop consuming the failed stream
-          }
-
-          // Non-session error — clean it
-          if (msg.error && typeof msg.error === 'string') {
-            msg.error = OpencodeProvider.cleanErrorMessage(msg.error);
-          }
-        } else {
-          // A non-error message is a healthy signal — stop buffering after this
-          seenHealthyMessage = true;
-        }
-
-        if (seenHealthyMessage && buffered.length > 0) {
-          // Flush the pre-healthy buffer first, then switch to passthrough
-          for (const bufferedMsg of buffered) {
-            yield bufferedMsg;
-          }
-          buffered.length = 0;
-        }
-
-        if (seenHealthyMessage) {
-          // Passthrough mode — yield directly without buffering
-          yield msg;
-        } else {
-          // Still in initial window — buffer until we see a healthy message
-          buffered.push(msg);
-        }
-      }
-    } catch (error) {
-      // Also handle thrown exceptions (e.g. from mapError in cli-provider)
-      const errMsg = error instanceof Error ? error.message : String(error);
-      if (OpencodeProvider.isSessionNotFoundError(errMsg)) {
-        sessionError = true;
-        opencodeLogger.info(
-          `OpenCode session error detected (thrown, session "${options.sdkSessionId}") ` +
-            `— retrying without --session to start fresh`
-        );
-      } else {
-        throw error;
-      }
-    }
-
-    if (sessionError) {
-      // Retry the entire query without the stale session ID.
-      const retryOptions = { ...options, sdkSessionId: undefined };
-      opencodeLogger.info('Retrying OpenCode query without --session flag...');
-
-      // Stream the retry directly to the consumer.
-      // If the retry also fails, it's a genuine error (not session-related)
-      // and should be surfaced as-is rather than masked with a misleading
-      // "session could not be created" message.
-      for await (const retryMsg of super.executeQuery(retryOptions)) {
-        if (retryMsg.type === 'error' && retryMsg.error && typeof retryMsg.error === 'string') {
-          retryMsg.error = OpencodeProvider.cleanErrorMessage(retryMsg.error);
-        }
-        yield retryMsg;
-      }
-    } else if (buffered.length > 0) {
-      // No session error and still have buffered messages (stream ended before
-      // any healthy message was observed) — flush them to the consumer
-      for (const msg of buffered) {
-        yield msg;
-      }
-    }
-    // If seenHealthyMessage is true, all messages have already been yielded
-    // directly in passthrough mode — nothing left to flush.
-  }
-
   /**
    * Normalize a raw CLI event to ProviderMessage format
    *
    * Maps OpenCode event types to the standard ProviderMessage structure:
    * - text -> type: 'assistant', content with type: 'text'
    * - step_start -> null (informational, no message needed)
-   * - step_finish with reason 'stop'/'end_turn' -> type: 'result', subtype: 'success'
-   * - step_finish with reason 'tool-calls' -> null (intermediate step, not final)
+   * - step_finish with reason 'stop' -> type: 'result', subtype: 'success'
    * - step_finish with error -> type: 'error'
-   * - tool_use -> type: 'assistant', content with type: 'tool_use' (OpenCode CLI format)
-   * - tool_call -> type: 'assistant', content with type: 'tool_use' (legacy format)
+   * - tool_call -> type: 'assistant', content with type: 'tool_use'
    * - tool_result -> type: 'assistant', content with type: 'tool_result'
    * - error -> type: 'error'
    *
@@ -700,7 +459,7 @@ export class OpencodeProvider extends CliProvider {
           return {
             type: 'error',
             session_id: finishEvent.sessionID,
-            error: OpencodeProvider.cleanErrorMessage(finishEvent.part.error),
+            error: finishEvent.part.error,
           };
         }
 
@@ -709,40 +468,15 @@ export class OpencodeProvider extends CliProvider {
           return {
             type: 'error',
             session_id: finishEvent.sessionID,
-            error: OpencodeProvider.cleanErrorMessage('Step execution failed'),
+            error: 'Step execution failed',
           };
         }
 
-        // Intermediate step completion (reason: 'tool-calls') — the agent loop
-        // is continuing because the model requested tool calls. Skip these so
-        // consumers don't mistake them for final results.
-        if (finishEvent.part?.reason === 'tool-calls') {
-          return null;
-        }
-
-        // Only treat an explicit allowlist of reasons as true success.
-        // Reasons like 'length' (context-window truncation) or 'content-filter'
-        // indicate the model stopped abnormally and must not be surfaced as
-        // successful completions.
-        const SUCCESS_REASONS = new Set(['stop', 'end_turn']);
-        const reason = finishEvent.part?.reason;
-
-        if (reason === undefined || SUCCESS_REASONS.has(reason)) {
-          // Final completion (reason: 'stop', 'end_turn', or unset)
-          return {
-            type: 'result',
-            subtype: 'success',
-            session_id: finishEvent.sessionID,
-            result: (finishEvent.part as OpenCodePart & { result?: string })?.result,
-          };
-        }
-
-        // Non-success, non-tool-calls reason (e.g. 'length', 'content-filter')
+        // Successful completion (reason: 'stop' or 'end_turn')
         return {
           type: 'result',
-          subtype: 'error',
+          subtype: 'success',
           session_id: finishEvent.sessionID,
-          error: `Step finished with non-success reason: ${reason}`,
           result: (finishEvent.part as OpenCodePart & { result?: string })?.result,
         };
       }
@@ -750,10 +484,8 @@ export class OpencodeProvider extends CliProvider {
       case 'tool_error': {
         const toolErrorEvent = openCodeEvent as OpenCodeBaseEvent;
 
-        // Extract error message from part.error and clean ANSI codes
-        const errorMessage = OpencodeProvider.cleanErrorMessage(
-          toolErrorEvent.part?.error || 'Tool execution failed'
-        );
+        // Extract error message from part.error
+        const errorMessage = toolErrorEvent.part?.error || 'Tool execution failed';
 
         return {
           type: 'error',
@@ -762,45 +494,6 @@ export class OpencodeProvider extends CliProvider {
         };
       }
 
-      // OpenCode CLI emits 'tool_use' events (not 'tool_call') when the model invokes a tool.
-      // The event format includes the tool name, call ID, and state with input/output.
-      // Handle both 'tool_use' (actual CLI format) and 'tool_call' (legacy/alternative) for robustness.
-      case 'tool_use': {
-        const toolUseEvent = openCodeEvent as OpenCodeToolUseEvent;
-        const part = toolUseEvent.part;
-
-        // Generate a tool use ID if not provided
-        const toolUseId = part?.callID || part?.call_id || generateToolUseId();
-        const toolName = part?.tool || part?.name || 'unknown';
-
-        const content: ContentBlock[] = [
-          {
-            type: 'tool_use',
-            name: toolName,
-            tool_use_id: toolUseId,
-            input: part?.state?.input || part?.args,
-          },
-        ];
-
-        // If the tool has already completed (state.status === 'completed'), also emit the result
-        if (part?.state?.status === 'completed' && part?.state?.output) {
-          content.push({
-            type: 'tool_result',
-            tool_use_id: toolUseId,
-            content: part.state.output,
-          });
-        }
-
-        return {
-          type: 'assistant',
-          session_id: toolUseEvent.sessionID,
-          message: {
-            role: 'assistant',
-            content,
-          },
-        };
-      }
-
       case 'tool_call': {
         const toolEvent = openCodeEvent as OpenCodeToolCallEvent;
 
@@ -867,13 +560,6 @@ export class OpencodeProvider extends CliProvider {
           errorMessage = errorEvent.part.error;
         }
 
-        // Clean error messages: strip ANSI escape codes AND the redundant "Error: "
-        // prefix the CLI adds. The OpenCode CLI outputs colored stderr like:
-        //   \x1b[91m\x1b[1mError: \x1b[0mSession not found
-        // Without cleaning, consumers that wrap in their own "Error: " prefix
-        // produce "Error: Error: Session not found".
-        errorMessage = OpencodeProvider.cleanErrorMessage(errorMessage);
-
         return {
           type: 'error',
           session_id: errorEvent.sessionID,
@@ -937,9 +623,9 @@ export class OpencodeProvider extends CliProvider {
         default: true,
       },
       {
-        id: 'opencode/glm-5-free',
-        name: 'GLM 5 Free',
-        modelString: 'opencode/glm-5-free',
+        id: 'opencode/glm-4.7-free',
+        name: 'GLM 4.7 Free',
+        modelString: 'opencode/glm-4.7-free',
         provider: 'opencode',
         description: 'OpenCode free tier GLM model',
         supportsTools: true,
@@ -957,19 +643,19 @@ export class OpencodeProvider extends CliProvider {
         tier: 'basic',
       },
       {
-        id: 'opencode/kimi-k2.5-free',
-        name: 'Kimi K2.5 Free',
-        modelString: 'opencode/kimi-k2.5-free',
+        id: 'opencode/grok-code',
+        name: 'Grok Code (Free)',
+        modelString: 'opencode/grok-code',
         provider: 'opencode',
-        description: 'OpenCode free tier Kimi model for coding',
+        description: 'OpenCode free tier Grok model for coding',
         supportsTools: true,
         supportsVision: false,
         tier: 'basic',
       },
       {
-        id: 'opencode/minimax-m2.5-free',
-        name: 'MiniMax M2.5 Free',
-        modelString: 'opencode/minimax-m2.5-free',
+        id: 'opencode/minimax-m2.1-free',
+        name: 'MiniMax M2.1 Free',
+        modelString: 'opencode/minimax-m2.1-free',
         provider: 'opencode',
         description: 'OpenCode free tier MiniMax model',
         supportsTools: true,
@@ -1091,7 +777,7 @@ export class OpencodeProvider extends CliProvider {
    *
    * OpenCode CLI output format (one model per line):
    * opencode/big-pickle
-   * opencode/glm-5-free
+   * opencode/glm-4.7-free
    * anthropic/claude-3-5-haiku-20241022
    * github-copilot/claude-3.5-sonnet
    * ...

apps/server/src/providers/provider-factory.ts

@@ -103,7 +103,7 @@ export class ProviderFactory {
   /**
    * Get the appropriate provider for a given model ID
    *
-   * @param modelId Model identifier (e.g., "claude-opus-4-6", "cursor-gpt-4o", "cursor-auto")
+   * @param modelId Model identifier (e.g., "claude-opus-4-5-20251101", "cursor-gpt-4o", "cursor-auto")
    * @param options Optional settings
    * @param options.throwOnDisconnected Throw error if provider is disconnected (default: true)
    * @returns Provider instance for the model

apps/server/src/providers/simple-query-service.ts

@@ -16,6 +16,8 @@
 
 import { ProviderFactory } from './provider-factory.js';
 import type {
+  ProviderMessage,
+  ContentBlock,
   ThinkingLevel,
   ReasoningEffort,
   ClaudeApiProfile,
@@ -94,7 +96,7 @@ export interface StreamingQueryOptions extends SimpleQueryOptions {
 /**
  * Default model to use when none specified
  */
-const DEFAULT_MODEL = 'claude-sonnet-4-6';
+const DEFAULT_MODEL = 'claude-sonnet-4-20250514';
 
 /**
  * Execute a simple query and return the text result

apps/server/src/routes/agent/routes/history.ts

@@ -16,7 +16,7 @@ export function createHistoryHandler(agentService: AgentService) {
         return;
       }
 
-      const result = await agentService.getHistory(sessionId);
+      const result = agentService.getHistory(sessionId);
       res.json(result);
     } catch (error) {
       logError(error, 'Get history failed');

apps/server/src/routes/agent/routes/queue-list.ts

@@ -19,7 +19,7 @@ export function createQueueListHandler(agentService: AgentService) {
         return;
       }
 
-      const result = await agentService.getQueue(sessionId);
+      const result = agentService.getQueue(sessionId);
       res.json(result);
     } catch (error) {
       logError(error, 'List queue failed');

apps/server/src/routes/agent/routes/send.ts

@@ -53,15 +53,7 @@ export function createSendHandler(agentService: AgentService) {
           thinkingLevel,
         })
         .catch((error) => {
-          const errorMsg = (error as Error).message || 'Unknown error';
-          logger.error(`Background error in sendMessage() for session ${sessionId}:`, errorMsg);
-
-          // Emit error via WebSocket so the UI is notified even though
-          // the HTTP response already returned 200. This is critical for
-          // session-not-found errors where sendMessage() throws before it
-          // can emit its own error event (no in-memory session to emit from).
-          agentService.emitSessionError(sessionId, errorMsg);
-
+          logger.error('Background error in sendMessage():', error);
           logError(error, 'Send message failed (background)');
         });
 

apps/server/src/routes/agent/routes/start.ts

@@ -6,7 +6,7 @@ import type { Request, Response } from 'express';
 import { AgentService } from '../../../services/agent-service.js';
 import { createLogger } from '@automaker/utils';
 import { getErrorMessage, logError } from '../common.js';
-const _logger = createLogger('Agent');
+const logger = createLogger('Agent');
 
 export function createStartHandler(agentService: AgentService) {
   return async (req: Request, res: Response): Promise<void> => {

apps/server/src/routes/app-spec/common.ts

@@ -128,7 +128,7 @@ export function logAuthStatus(context: string): void {
  */
 export function logError(error: unknown, context: string): void {
   logger.error(`❌ ${context}:`);
-  logger.error('Error name:', (error as Error)?.name);
+  logger.error('Error name:', (error as any)?.name);
   logger.error('Error message:', (error as Error)?.message);
   logger.error('Error stack:', (error as Error)?.stack);
   logger.error('Full error object:', JSON.stringify(error, Object.getOwnPropertyNames(error), 2));

apps/server/src/routes/app-spec/generate-features-from-spec.ts

@@ -30,7 +30,7 @@ const DEFAULT_MAX_FEATURES = 50;
  * Timeout for Codex models when generating features (5 minutes).
  * Codex models are slower and need more time to generate 50+ features.
  */
-const _CODEX_FEATURE_GENERATION_TIMEOUT_MS = 300000; // 5 minutes
+const CODEX_FEATURE_GENERATION_TIMEOUT_MS = 300000; // 5 minutes
 
 /**
  * Type for extracted features JSON response

apps/server/src/routes/app-spec/sync-spec.ts

@@ -29,6 +29,7 @@ import {
   updateTechnologyStack,
   updateRoadmapPhaseStatus,
   type ImplementedFeature,
+  type RoadmapPhase,
 } from '../../lib/xml-extractor.js';
 import { getNotificationService } from '../../services/notification-service.js';
 

apps/server/src/routes/auto-mode/index.ts

@@ -21,7 +21,6 @@ import { createFollowUpFeatureHandler } from './routes/follow-up-feature.js';
 import { createCommitFeatureHandler } from './routes/commit-feature.js';
 import { createApprovePlanHandler } from './routes/approve-plan.js';
 import { createResumeInterruptedHandler } from './routes/resume-interrupted.js';
-import { createReconcileHandler } from './routes/reconcile.js';
 
 /**
  * Create auto-mode routes.
@@ -82,11 +81,6 @@ export function createAutoModeRoutes(autoModeService: AutoModeServiceCompat): Ro
     validatePathParams('projectPath'),
     createResumeInterruptedHandler(autoModeService)
   );
-  router.post(
-    '/reconcile',
-    validatePathParams('projectPath'),
-    createReconcileHandler(autoModeService)
-  );
 
   return router;
 }

apps/server/src/routes/auto-mode/routes/analyze-project.ts

@@ -19,11 +19,10 @@ export function createAnalyzeProjectHandler(autoModeService: AutoModeServiceComp
         return;
       }
 
-      // Kick off analysis in the background; attach a rejection handler so
-      // unhandled-promise warnings don't surface and errors are at least logged.
-      // Synchronous throws (e.g. "not implemented") still propagate here.
-      const analysisPromise = autoModeService.analyzeProject(projectPath);
-      analysisPromise.catch((err) => logError(err, 'Background analyzeProject failed'));
+      // Start analysis in background
+      autoModeService.analyzeProject(projectPath).catch((error) => {
+        logger.error(`[AutoMode] Project analysis error:`, error);
+      });
 
       res.json({ success: true, message: 'Project analysis started' });
     } catch (error) {

apps/server/src/routes/auto-mode/routes/approve-plan.ts

@@ -17,7 +17,7 @@ export function createApprovePlanHandler(autoModeService: AutoModeServiceCompat)
         approved: boolean;
         editedPlan?: string;
         feedback?: string;
-        projectPath: string;
+        projectPath?: string;
       };
 
       if (!featureId) {
@@ -36,14 +36,6 @@ export function createApprovePlanHandler(autoModeService: AutoModeServiceCompat)
         return;
       }
 
-      if (!projectPath) {
-        res.status(400).json({
-          success: false,
-          error: 'projectPath is required',
-        });
-        return;
-      }
-
       // Note: We no longer check hasPendingApproval here because resolvePlanApproval
       // can handle recovery when pending approval is not in Map but feature has planSpec.status='generated'
       // This supports cases where the server restarted while waiting for approval
@@ -56,7 +48,7 @@ export function createApprovePlanHandler(autoModeService: AutoModeServiceCompat)
 
       // Resolve the pending approval (with recovery support)
       const result = await autoModeService.resolvePlanApproval(
-        projectPath,
+        projectPath || '',
         featureId,
         approved,
         editedPlan,

apps/server/src/routes/auto-mode/routes/reconcile.ts

@@ -1,53 +0,0 @@
-/**
- * Reconcile Feature States Handler
- *
- * On-demand endpoint to reconcile all feature states for a project.
- * Resets features stuck in transient states (in_progress, interrupted, pipeline_*)
- * back to resting states (ready/backlog) and emits events to update the UI.
- *
- * This is useful when:
- * - The UI reconnects after a server restart
- * - A client detects stale feature states
- * - An admin wants to force-reset stuck features
- */
-
-import type { Request, Response } from 'express';
-import { createLogger } from '@automaker/utils';
-import type { AutoModeServiceCompat } from '../../../services/auto-mode/index.js';
-
-const logger = createLogger('ReconcileFeatures');
-
-interface ReconcileRequest {
-  projectPath: string;
-}
-
-export function createReconcileHandler(autoModeService: AutoModeServiceCompat) {
-  return async (req: Request, res: Response): Promise<void> => {
-    const { projectPath } = req.body as ReconcileRequest;
-
-    if (!projectPath) {
-      res.status(400).json({ error: 'Project path is required' });
-      return;
-    }
-
-    logger.info(`Reconciling feature states for ${projectPath}`);
-
-    try {
-      const reconciledCount = await autoModeService.reconcileFeatureStates(projectPath);
-
-      res.json({
-        success: true,
-        reconciledCount,
-        message:
-          reconciledCount > 0
-            ? `Reconciled ${reconciledCount} feature(s)`
-            : 'No features needed reconciliation',
-      });
-    } catch (error) {
-      logger.error('Error reconciling feature states:', error);
-      res.status(500).json({
-        error: error instanceof Error ? error.message : 'Unknown error',
-      });
-    }
-  };
-}

apps/server/src/routes/auto-mode/routes/run-feature.ts

@@ -26,9 +26,23 @@ export function createRunFeatureHandler(autoModeService: AutoModeServiceCompat)
         return;
       }
 
-      // Note: No concurrency limit check here. Manual feature starts always run
-      // immediately and bypass the concurrency limit. Their presence IS counted
-      // by the auto-loop coordinator when deciding whether to dispatch new auto-mode tasks.
+      // Check per-worktree capacity before starting
+      const capacity = await autoModeService.checkWorktreeCapacity(projectPath, featureId);
+      if (!capacity.hasCapacity) {
+        const worktreeDesc = capacity.branchName
+          ? `worktree "${capacity.branchName}"`
+          : 'main worktree';
+        res.status(429).json({
+          success: false,
+          error: `Agent limit reached for ${worktreeDesc} (${capacity.currentAgents}/${capacity.maxAgents}). Wait for running tasks to complete or increase the limit.`,
+          details: {
+            currentAgents: capacity.currentAgents,
+            maxAgents: capacity.maxAgents,
+            branchName: capacity.branchName,
+          },
+        });
+        return;
+      }
 
       // Start execution in background
       // executeFeature derives workDir from feature.branchName

apps/server/src/routes/auto-mode/routes/status.ts

@@ -25,7 +25,7 @@ export function createStatusHandler(autoModeService: AutoModeServiceCompat) {
         // Normalize branchName: undefined becomes null
         const normalizedBranchName = branchName ?? null;
 
-        const projectStatus = await autoModeService.getStatusForProject(
+        const projectStatus = autoModeService.getStatusForProject(
           projectPath,
           normalizedBranchName
         );

apps/server/src/routes/backlog-plan/common.ts

@@ -114,20 +114,9 @@ export function mapBacklogPlanError(rawMessage: string): string {
     return 'Claude CLI could not be launched. Make sure the Claude CLI is installed and available in PATH, or check that Node.js is correctly installed. Try running "which claude" or "claude --version" in your terminal to verify.';
   }
 
-  // Claude Code process crash - extract exit code for diagnostics
+  // Claude Code process crash
   if (rawMessage.includes('Claude Code process exited')) {
-    const exitCodeMatch = rawMessage.match(/exited with code (\d+)/);
-    const exitCode = exitCodeMatch ? exitCodeMatch[1] : 'unknown';
-    logger.error(`[BacklogPlan] Claude process exit code: ${exitCode}`);
-    return `Claude exited unexpectedly (exit code: ${exitCode}). This is usually a transient issue. Try again. If it keeps happening, re-run \`claude login\` or update your API key in Setup.`;
-  }
-
-  // Claude Code process killed by signal
-  if (rawMessage.includes('Claude Code process terminated by signal')) {
-    const signalMatch = rawMessage.match(/terminated by signal (\w+)/);
-    const signal = signalMatch ? signalMatch[1] : 'unknown';
-    logger.error(`[BacklogPlan] Claude process terminated by signal: ${signal}`);
-    return `Claude was terminated by signal ${signal}. This may indicate a resource issue. Try again.`;
+    return 'Claude exited unexpectedly. Try again. If it keeps happening, re-run `claude login` or update your API key in Setup.';
   }
 
   // Rate limiting

apps/server/src/routes/backlog-plan/generate-plan.ts

@@ -3,22 +3,17 @@
  *
  * Model is configurable via phaseModels.backlogPlanningModel in settings
  * (defaults to Sonnet). Can be overridden per-call via model parameter.
- *
- * Includes automatic retry for transient CLI failures (e.g., "Claude Code
- * process exited unexpectedly") to improve reliability.
  */
 
 import type { EventEmitter } from '../../lib/events.js';
-import type { Feature, BacklogPlanResult } from '@automaker/types';
+import type { Feature, BacklogPlanResult, BacklogChange, DependencyUpdate } from '@automaker/types';
 import {
   DEFAULT_PHASE_MODELS,
   isCursorModel,
   stripProviderPrefix,
   type ThinkingLevel,
-  type SystemPromptPreset,
 } from '@automaker/types';
 import { resolvePhaseModel } from '@automaker/model-resolver';
-import { getCurrentBranch } from '@automaker/git-utils';
 import { FeatureLoader } from '../../services/feature-loader.js';
 import { ProviderFactory } from '../../providers/provider-factory.js';
 import { extractJsonWithArray } from '../../lib/json-extractor.js';
@@ -32,28 +27,10 @@ import {
 import type { SettingsService } from '../../services/settings-service.js';
 import {
   getAutoLoadClaudeMdSetting,
-  getUseClaudeCodeSystemPromptSetting,
   getPromptCustomization,
   getPhaseModelWithOverrides,
-  getProviderByModelId,
 } from '../../lib/settings-helpers.js';
 
-/** Maximum number of retry attempts for transient CLI failures */
-const MAX_RETRIES = 2;
-/** Delay between retries in milliseconds */
-const RETRY_DELAY_MS = 2000;
-
-/**
- * Check if an error is retryable (transient CLI process failure)
- */
-function isRetryableError(error: unknown): boolean {
-  const message = error instanceof Error ? error.message : String(error);
-  return (
-    message.includes('Claude Code process exited') ||
-    message.includes('Claude Code process terminated by signal')
-  );
-}
-
 const featureLoader = new FeatureLoader();
 
 /**
@@ -107,53 +84,6 @@ function parsePlanResponse(response: string): BacklogPlanResult {
   };
 }
 
-/**
- * Try to parse a valid plan response without fallback behavior.
- * Returns null if parsing fails.
- */
-function tryParsePlanResponse(response: string): BacklogPlanResult | null {
-  if (!response || response.trim().length === 0) {
-    return null;
-  }
-  return extractJsonWithArray<BacklogPlanResult>(response, 'changes', { logger });
-}
-
-/**
- * Choose the most reliable response text between streamed assistant chunks
- * and provider final result payload.
- */
-function selectBestResponseText(accumulatedText: string, providerResultText: string): string {
-  const hasAccumulated = accumulatedText.trim().length > 0;
-  const hasProviderResult = providerResultText.trim().length > 0;
-
-  if (!hasProviderResult) {
-    return accumulatedText;
-  }
-  if (!hasAccumulated) {
-    return providerResultText;
-  }
-
-  const accumulatedParsed = tryParsePlanResponse(accumulatedText);
-  const providerParsed = tryParsePlanResponse(providerResultText);
-
-  if (providerParsed && !accumulatedParsed) {
-    logger.info('[BacklogPlan] Using provider result (parseable JSON)');
-    return providerResultText;
-  }
-  if (accumulatedParsed && !providerParsed) {
-    logger.info('[BacklogPlan] Keeping accumulated text (parseable JSON)');
-    return accumulatedText;
-  }
-
-  if (providerResultText.length > accumulatedText.length) {
-    logger.info('[BacklogPlan] Using provider result (longer content)');
-    return providerResultText;
-  }
-
-  logger.info('[BacklogPlan] Keeping accumulated text (longer content)');
-  return accumulatedText;
-}
-
 /**
  * Generate a backlog modification plan based on user prompt
  */
@@ -163,40 +93,11 @@ export async function generateBacklogPlan(
   events: EventEmitter,
   abortController: AbortController,
   settingsService?: SettingsService,
-  model?: string,
-  branchName?: string
+  model?: string
 ): Promise<BacklogPlanResult> {
   try {
     // Load current features
-    const allFeatures = await featureLoader.getAll(projectPath);
-
-    // Filter features by branch if specified (worktree-scoped backlog)
-    let features: Feature[];
-    if (branchName) {
-      // Determine the primary branch so unassigned features show for the main worktree
-      let primaryBranch: string | null = null;
-      try {
-        primaryBranch = await getCurrentBranch(projectPath);
-      } catch {
-        // If git fails, fall back to 'main' so unassigned features are visible
-        // when branchName matches a common default branch name
-        primaryBranch = 'main';
-      }
-      const isMainBranch = branchName === primaryBranch;
-
-      features = allFeatures.filter((f) => {
-        if (!f.branchName) {
-          // Unassigned features belong to the main/primary worktree
-          return isMainBranch;
-        }
-        return f.branchName === branchName;
-      });
-      logger.info(
-        `[BacklogPlan] Filtered to ${features.length}/${allFeatures.length} features for branch: ${branchName}`
-      );
-    } else {
-      features = allFeatures;
-    }
+    const features = await featureLoader.getAll(projectPath);
 
     events.emit('backlog-plan:event', {
       type: 'backlog_plan_progress',
@@ -232,35 +133,6 @@ export async function generateBacklogPlan(
       effectiveModel = resolved.model;
       thinkingLevel = resolved.thinkingLevel;
       credentials = await settingsService?.getCredentials();
-      // Resolve Claude-compatible provider when client sends a model (e.g. MiniMax, GLM)
-      if (settingsService) {
-        const providerResult = await getProviderByModelId(
-          effectiveModel,
-          settingsService,
-          '[BacklogPlan]'
-        );
-        if (providerResult.provider) {
-          claudeCompatibleProvider = providerResult.provider;
-          if (providerResult.credentials) {
-            credentials = providerResult.credentials;
-          }
-        }
-        // Fallback: use phase settings provider if model lookup found nothing (e.g. model
-        // string format differs from provider's model id, but backlog planning phase has providerId).
-        if (!claudeCompatibleProvider) {
-          const phaseResult = await getPhaseModelWithOverrides(
-            'backlogPlanningModel',
-            settingsService,
-            projectPath,
-            '[BacklogPlan]'
-          );
-          const phaseResolved = resolvePhaseModel(phaseResult.phaseModel);
-          if (phaseResult.provider && phaseResolved.model === effectiveModel) {
-            claudeCompatibleProvider = phaseResult.provider;
-            credentials = phaseResult.credentials ?? credentials;
-          }
-        }
-      }
     } else if (settingsService) {
       // Use settings-based model with provider info
       const phaseResult = await getPhaseModelWithOverrides(
@@ -290,23 +162,17 @@ export async function generateBacklogPlan(
     // Strip provider prefix - providers expect bare model IDs
     const bareModel = stripProviderPrefix(effectiveModel);
 
-    // Get autoLoadClaudeMd and useClaudeCodeSystemPrompt settings
+    // Get autoLoadClaudeMd setting
     const autoLoadClaudeMd = await getAutoLoadClaudeMdSetting(
       projectPath,
       settingsService,
       '[BacklogPlan]'
     );
-    const useClaudeCodeSystemPrompt = await getUseClaudeCodeSystemPromptSetting(
-      projectPath,
-      settingsService,
-      '[BacklogPlan]'
-    );
 
     // For Cursor models, we need to combine prompts with explicit instructions
     // because Cursor doesn't support systemPrompt separation like Claude SDK
     let finalPrompt = userPrompt;
-    let finalSystemPrompt: string | SystemPromptPreset | undefined = systemPrompt;
-    let finalSettingSources: Array<'user' | 'project' | 'local'> | undefined;
+    let finalSystemPrompt: string | undefined = systemPrompt;
 
     if (isCursorModel(effectiveModel)) {
       logger.info('[BacklogPlan] Using Cursor model - adding explicit no-file-write instructions');
@@ -321,145 +187,54 @@ CRITICAL INSTRUCTIONS:
 
 ${userPrompt}`;
       finalSystemPrompt = undefined; // System prompt is now embedded in the user prompt
-    } else if (claudeCompatibleProvider) {
-      // Claude-compatible providers (MiniMax, GLM, etc.) use a plain API; do not use
-      // the claude_code preset (which is for Claude CLI/subprocess and can break the request).
-      finalSystemPrompt = systemPrompt;
-    } else if (useClaudeCodeSystemPrompt) {
-      // Use claude_code preset for native Claude so the SDK subprocess
-      // authenticates via CLI OAuth or API key the same way all other SDK calls do.
-      finalSystemPrompt = {
-        type: 'preset',
-        preset: 'claude_code',
-        append: systemPrompt,
-      };
-    }
-    // Include settingSources when autoLoadClaudeMd is enabled
-    if (autoLoadClaudeMd) {
-      finalSettingSources = ['user', 'project'];
     }
 
-    // Execute the query with retry logic for transient CLI failures
-    const queryOptions = {
+    // Execute the query
+    const stream = provider.executeQuery({
       prompt: finalPrompt,
       model: bareModel,
       cwd: projectPath,
       systemPrompt: finalSystemPrompt,
       maxTurns: 1,
-      tools: [] as string[], // Disable all built-in tools - plan generation only needs text output
+      allowedTools: [], // No tools needed for this
       abortController,
-      settingSources: finalSettingSources,
+      settingSources: autoLoadClaudeMd ? ['user', 'project'] : undefined,
+      readOnly: true, // Plan generation only generates text, doesn't write files
       thinkingLevel, // Pass thinking level for extended thinking
       claudeCompatibleProvider, // Pass provider for alternative endpoint configuration
       credentials, // Pass credentials for resolving 'credentials' apiKeySource
-    };
+    });
 
     let responseText = '';
-    let bestResponseText = ''; // Preserve best response across all retry attempts
-    let recoveredResult: BacklogPlanResult | null = null;
-    let lastError: unknown = null;
 
-    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    for await (const msg of stream) {
       if (abortController.signal.aborted) {
         throw new Error('Generation aborted');
       }
 
-      if (attempt > 0) {
-        logger.info(
-          `[BacklogPlan] Retry attempt ${attempt}/${MAX_RETRIES} after transient failure`
-        );
-        events.emit('backlog-plan:event', {
-          type: 'backlog_plan_progress',
-          content: `Retrying... (attempt ${attempt + 1}/${MAX_RETRIES + 1})`,
-        });
-        await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY_MS));
-      }
-
-      let accumulatedText = '';
-      let providerResultText = '';
-
-      try {
-        const stream = provider.executeQuery(queryOptions);
-
-        for await (const msg of stream) {
-          if (abortController.signal.aborted) {
-            throw new Error('Generation aborted');
-          }
-
-          if (msg.type === 'assistant') {
-            if (msg.message?.content) {
-              for (const block of msg.message.content) {
-                if (block.type === 'text') {
-                  accumulatedText += block.text;
-                }
-              }
+      if (msg.type === 'assistant') {
+        if (msg.message?.content) {
+          for (const block of msg.message.content) {
+            if (block.type === 'text') {
+              responseText += block.text;
             }
-          } else if (msg.type === 'result' && msg.subtype === 'success' && msg.result) {
-            providerResultText = msg.result;
-            logger.info(
-              '[BacklogPlan] Received result from provider, length:',
-              providerResultText.length
-            );
-            logger.info('[BacklogPlan] Accumulated response length:', accumulatedText.length);
           }
         }
-
-        responseText = selectBestResponseText(accumulatedText, providerResultText);
-
-        // If we got here, the stream completed successfully
-        lastError = null;
-        break;
-      } catch (error) {
-        lastError = error;
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        responseText = selectBestResponseText(accumulatedText, providerResultText);
-
-        // Preserve the best response text across all attempts so that if a retry
-        // crashes immediately (empty response), we can still recover from an earlier attempt
-        bestResponseText = selectBestResponseText(bestResponseText, responseText);
-
-        // Claude SDK can occasionally exit non-zero after emitting a complete response.
-        // If we already have valid JSON, recover instead of failing the entire planning flow.
-        if (isRetryableError(error)) {
-          const parsed = tryParsePlanResponse(bestResponseText);
-          if (parsed) {
-            logger.warn(
-              '[BacklogPlan] Recovered from transient CLI exit using accumulated valid response'
-            );
-            recoveredResult = parsed;
-            lastError = null;
-            break;
-          }
-
-          // On final retryable failure, degrade gracefully if we have text from any attempt.
-          if (attempt >= MAX_RETRIES && bestResponseText.trim().length > 0) {
-            logger.warn(
-              '[BacklogPlan] Final retryable CLI failure with non-empty response, attempting fallback parse'
-            );
-            recoveredResult = parsePlanResponse(bestResponseText);
-            lastError = null;
-            break;
-          }
+      } else if (msg.type === 'result' && msg.subtype === 'success' && msg.result) {
+        // Use result if it's a final accumulated message (from Cursor provider)
+        logger.info('[BacklogPlan] Received result from Cursor, length:', msg.result.length);
+        logger.info('[BacklogPlan] Previous responseText length:', responseText.length);
+        if (msg.result.length > responseText.length) {
+          logger.info('[BacklogPlan] Using Cursor result (longer than accumulated text)');
+          responseText = msg.result;
+        } else {
+          logger.info('[BacklogPlan] Keeping accumulated text (longer than Cursor result)');
         }
-
-        // Only retry on transient CLI failures, not on user aborts or other errors
-        if (!isRetryableError(error) || attempt >= MAX_RETRIES) {
-          throw error;
-        }
-
-        logger.warn(
-          `[BacklogPlan] Transient CLI failure (attempt ${attempt + 1}/${MAX_RETRIES + 1}): ${errorMessage}`
-        );
       }
     }
 
-    // If we exhausted retries, throw the last error
-    if (lastError) {
-      throw lastError;
-    }
-
     // Parse the response
-    const result = recoveredResult ?? parsePlanResponse(responseText);
+    const result = parsePlanResponse(responseText);
 
     await saveBacklogPlan(projectPath, {
       savedAt: new Date().toISOString(),

apps/server/src/routes/backlog-plan/routes/apply.ts

@@ -3,7 +3,7 @@
  */
 
 import type { Request, Response } from 'express';
-import type { BacklogPlanResult } from '@automaker/types';
+import type { BacklogPlanResult, BacklogChange, Feature } from '@automaker/types';
 import { FeatureLoader } from '../../../services/feature-loader.js';
 import { clearBacklogPlan, getErrorMessage, logError, logger } from '../common.js';
 
@@ -58,9 +58,6 @@ export function createApplyHandler() {
             if (feature.dependencies?.includes(change.featureId)) {
               const newDeps = feature.dependencies.filter((d) => d !== change.featureId);
               await featureLoader.update(projectPath, feature.id, { dependencies: newDeps });
-              // Mutate the in-memory feature object so subsequent deletions use the updated
-              // dependency list and don't reintroduce already-removed dependency IDs.
-              feature.dependencies = newDeps;
               logger.info(
                 `[BacklogPlan] Removed dependency ${change.featureId} from ${feature.id}`
               );

apps/server/src/routes/backlog-plan/routes/generate.ts

@@ -17,11 +17,10 @@ import type { SettingsService } from '../../../services/settings-service.js';
 export function createGenerateHandler(events: EventEmitter, settingsService?: SettingsService) {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { projectPath, prompt, model, branchName } = req.body as {
+      const { projectPath, prompt, model } = req.body as {
         projectPath: string;
         prompt: string;
         model?: string;
-        branchName?: string;
       };
 
       if (!projectPath) {
@@ -43,30 +42,28 @@ export function createGenerateHandler(events: EventEmitter, settingsService?: Se
         return;
       }
 
-      const abortController = new AbortController();
-      setRunningState(true, abortController);
+      setRunningState(true);
       setRunningDetails({
         projectPath,
         prompt,
         model,
         startedAt: new Date().toISOString(),
       });
+      const abortController = new AbortController();
+      setRunningState(true, abortController);
 
       // Start generation in background
-      // Note: generateBacklogPlan handles its own error event emission
-      // and state cleanup in its finally block, so we only log here
-      generateBacklogPlan(
-        projectPath,
-        prompt,
-        events,
-        abortController,
-        settingsService,
-        model,
-        branchName
-      ).catch((error) => {
-        // Just log - error event already emitted by generateBacklogPlan
-        logError(error, 'Generate backlog plan failed (background)');
-      });
+      // Note: generateBacklogPlan handles its own error event emission,
+      // so we only log here to avoid duplicate error toasts
+      generateBacklogPlan(projectPath, prompt, events, abortController, settingsService, model)
+        .catch((error) => {
+          // Just log - error event already emitted by generateBacklogPlan
+          logError(error, 'Generate backlog plan failed (background)');
+        })
+        .finally(() => {
+          setRunningState(false, null);
+          setRunningDetails(null);
+        });
 
       res.json({ success: true });
     } catch (error) {

apps/server/src/routes/context/routes/describe-image.ts

@@ -142,33 +142,11 @@ function mapDescribeImageError(rawMessage: string | undefined): {
 
   if (!rawMessage) return baseResponse;
 
-  if (
-    rawMessage.includes('Claude Code process exited') ||
-    rawMessage.includes('Claude Code process terminated by signal')
-  ) {
-    const exitCodeMatch = rawMessage.match(/exited with code (\d+)/);
-    const signalMatch = rawMessage.match(/terminated by signal (\w+)/);
-    const detail = exitCodeMatch
-      ? ` (exit code: ${exitCodeMatch[1]})`
-      : signalMatch
-        ? ` (signal: ${signalMatch[1]})`
-        : '';
-
-    // Crash/OS-kill signals suggest a process crash, not an auth failure —
-    // omit auth recovery advice and suggest retry/reporting instead.
-    const crashSignals = ['SIGSEGV', 'SIGABRT', 'SIGKILL', 'SIGBUS', 'SIGTRAP'];
-    const isCrashSignal = signalMatch ? crashSignals.includes(signalMatch[1]) : false;
-
-    if (isCrashSignal) {
-      return {
-        statusCode: 503,
-        userMessage: `Claude crashed unexpectedly${detail} while describing the image. This may be a transient condition. Please try again. If the problem persists, collect logs and report the issue.`,
-      };
-    }
-
+  if (rawMessage.includes('Claude Code process exited')) {
     return {
       statusCode: 503,
-      userMessage: `Claude exited unexpectedly${detail} while describing the image. This is usually a transient issue. Try again. If it keeps happening, re-run \`claude login\` or update your API key in Setup.`,
+      userMessage:
+        'Claude exited unexpectedly while describing the image. Try again. If it keeps happening, re-run `claude login` or update your API key in Setup so Claude can restart cleanly.',
     };
   }
 

apps/server/src/routes/enhance-prompt/routes/enhance.ts

@@ -10,23 +10,14 @@ import type { Request, Response } from 'express';
 import { createLogger } from '@automaker/utils';
 import { resolveModelString } from '@automaker/model-resolver';
 import { CLAUDE_MODEL_MAP, type ThinkingLevel } from '@automaker/types';
-import { getAppSpecPath } from '@automaker/platform';
 import { simpleQuery } from '../../../providers/simple-query-service.js';
 import type { SettingsService } from '../../../services/settings-service.js';
 import { getPromptCustomization, getProviderByModelId } from '../../../lib/settings-helpers.js';
-import { FeatureLoader } from '../../../services/feature-loader.js';
-import * as secureFs from '../../../lib/secure-fs.js';
 import {
   buildUserPrompt,
   isValidEnhancementMode,
   type EnhancementMode,
 } from '../../../lib/enhancement-prompts.js';
-import {
-  extractTechnologyStack,
-  extractXmlElements,
-  extractXmlSection,
-  unescapeXml,
-} from '../../../lib/xml-extractor.js';
 
 const logger = createLogger('EnhancePrompt');
 
@@ -62,66 +53,6 @@ interface EnhanceErrorResponse {
   error: string;
 }
 
-async function buildProjectContext(projectPath: string): Promise<string | null> {
-  const contextBlocks: string[] = [];
-
-  try {
-    const appSpecPath = getAppSpecPath(projectPath);
-    const specContent = (await secureFs.readFile(appSpecPath, 'utf-8')) as string;
-
-    const projectName = extractXmlSection(specContent, 'project_name');
-    const overview = extractXmlSection(specContent, 'overview');
-    const techStack = extractTechnologyStack(specContent);
-    const coreSection = extractXmlSection(specContent, 'core_capabilities');
-    const coreCapabilities = coreSection ? extractXmlElements(coreSection, 'capability') : [];
-
-    const summaryLines: string[] = [];
-    if (projectName) {
-      summaryLines.push(`Name: ${unescapeXml(projectName.trim())}`);
-    }
-    if (overview) {
-      summaryLines.push(`Overview: ${unescapeXml(overview.trim())}`);
-    }
-    if (techStack.length > 0) {
-      summaryLines.push(`Tech Stack: ${techStack.join(', ')}`);
-    }
-    if (coreCapabilities.length > 0) {
-      summaryLines.push(`Core Capabilities: ${coreCapabilities.slice(0, 10).join(', ')}`);
-    }
-
-    if (summaryLines.length > 0) {
-      contextBlocks.push(`PROJECT CONTEXT:\n${summaryLines.map((line) => `- ${line}`).join('\n')}`);
-    }
-  } catch (error) {
-    logger.debug('No app_spec.txt context available for enhancement', error);
-  }
-
-  try {
-    const featureLoader = new FeatureLoader();
-    const features = await featureLoader.getAll(projectPath);
-    const featureTitles = features
-      .map((feature) => feature.title || feature.name || feature.id)
-      .filter((title) => Boolean(title));
-
-    if (featureTitles.length > 0) {
-      const listed = featureTitles.slice(0, 30).map((title) => `- ${title}`);
-      contextBlocks.push(
-        `EXISTING FEATURES (avoid duplicates):\n${listed.join('\n')}${
-          featureTitles.length > 30 ? '\n- ...' : ''
-        }`
-      );
-    }
-  } catch (error) {
-    logger.debug('Failed to load existing features for enhancement context', error);
-  }
-
-  if (contextBlocks.length === 0) {
-    return null;
-  }
-
-  return contextBlocks.join('\n\n');
-}
-
 /**
  * Create the enhance request handler
  *
@@ -191,10 +122,6 @@ export function createEnhanceHandler(
 
       // Build the user prompt with few-shot examples
       const userPrompt = buildUserPrompt(validMode, trimmedText, true);
-      const projectContext = projectPath ? await buildProjectContext(projectPath) : null;
-      if (projectContext) {
-        logger.debug('Including project context in enhancement prompt');
-      }
 
       // Check if the model is a provider model (like "GLM-4.5-Air")
       // If so, get the provider config and resolved Claude model
@@ -219,21 +146,18 @@ export function createEnhanceHandler(
         }
       }
 
-      // Resolve the model for API call.
-      // CRITICAL: For custom providers (GLM, MiniMax), pass the provider's model ID (e.g. "GLM-4.7")
-      // to the API, NOT the resolved Claude model - otherwise we get "model not found"
-      const modelForApi = claudeCompatibleProvider
-        ? model
-        : providerResolvedModel || resolveModelString(model, CLAUDE_MODEL_MAP.sonnet);
+      // Resolve the model - use provider resolved model, passed model, or default to sonnet
+      const resolvedModel =
+        providerResolvedModel || resolveModelString(model, CLAUDE_MODEL_MAP.sonnet);
 
-      logger.debug(`Using model: ${modelForApi}`);
+      logger.debug(`Using model: ${resolvedModel}`);
 
       // Use simpleQuery - provider abstraction handles routing to correct provider
       // The system prompt is combined with user prompt since some providers
       // don't have a separate system prompt concept
       const result = await simpleQuery({
-        prompt: [systemPrompt, projectContext, userPrompt].filter(Boolean).join('\n\n'),
-        model: modelForApi,
+        prompt: `${systemPrompt}\n\n${userPrompt}`,
+        model: resolvedModel,
         cwd: process.cwd(), // Enhancement doesn't need a specific working directory
         maxTurns: 1,
         allowedTools: [],

apps/server/src/routes/features/index.ts

@@ -33,22 +33,13 @@ export function createFeaturesRoutes(
     validatePathParams('projectPath'),
     createListHandler(featureLoader, autoModeService)
   );
-  router.get(
-    '/list',
-    validatePathParams('projectPath'),
-    createListHandler(featureLoader, autoModeService)
-  );
   router.post('/get', validatePathParams('projectPath'), createGetHandler(featureLoader));
   router.post(
     '/create',
     validatePathParams('projectPath'),
     createCreateHandler(featureLoader, events)
   );
-  router.post(
-    '/update',
-    validatePathParams('projectPath'),
-    createUpdateHandler(featureLoader, events)
-  );
+  router.post('/update', validatePathParams('projectPath'), createUpdateHandler(featureLoader));
   router.post(
     '/bulk-update',
     validatePathParams('projectPath'),

apps/server/src/routes/features/routes/create.ts

@@ -24,6 +24,19 @@ export function createCreateHandler(featureLoader: FeatureLoader, events?: Event
         return;
       }
 
+      // Check for duplicate title if title is provided
+      if (feature.title && feature.title.trim()) {
+        const duplicate = await featureLoader.findDuplicateTitle(projectPath, feature.title);
+        if (duplicate) {
+          res.status(409).json({
+            success: false,
+            error: `A feature with title "${feature.title}" already exists`,
+            duplicateFeatureId: duplicate.id,
+          });
+          return;
+        }
+      }
+
       const created = await featureLoader.create(projectPath, feature);
 
       // Emit feature_created event for hooks

apps/server/src/routes/features/routes/export.ts

@@ -36,7 +36,7 @@ interface ExportRequest {
   };
 }
 
-export function createExportHandler(_featureLoader: FeatureLoader) {
+export function createExportHandler(featureLoader: FeatureLoader) {
   const exportService = getFeatureExportService();
 
   return async (req: Request, res: Response): Promise<void> => {

apps/server/src/routes/features/routes/generate-title.ts

@@ -34,7 +34,7 @@ export function createGenerateTitleHandler(
 ): (req: Request, res: Response) => Promise<void> {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { description } = req.body as GenerateTitleRequestBody;
+      const { description, projectPath } = req.body as GenerateTitleRequestBody;
 
       if (!description || typeof description !== 'string') {
         const response: GenerateTitleErrorResponse = {

apps/server/src/routes/features/routes/import.ts

@@ -33,7 +33,7 @@ interface ConflictInfo {
   hasConflict: boolean;
 }
 
-export function createImportHandler(_featureLoader: FeatureLoader) {
+export function createImportHandler(featureLoader: FeatureLoader) {
   const exportService = getFeatureExportService();
 
   return async (req: Request, res: Response): Promise<void> => {

apps/server/src/routes/features/routes/list.ts

@@ -1,7 +1,5 @@
 /**
- * POST/GET /list endpoint - List all features for a project
- *
- * projectPath may come from req.body (POST) or req.query (GET fallback).
+ * POST /list endpoint - List all features for a project
  *
  * Also performs orphan detection when a project is loaded to identify
  * features whose branches no longer exist. This runs on every project load/switch.
@@ -21,17 +19,7 @@ export function createListHandler(
 ) {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const bodyProjectPath =
-        typeof req.body === 'object' && req.body !== null
-          ? (req.body as { projectPath?: unknown }).projectPath
-          : undefined;
-      const queryProjectPath = req.query.projectPath;
-      const projectPath =
-        typeof bodyProjectPath === 'string'
-          ? bodyProjectPath
-          : typeof queryProjectPath === 'string'
-            ? queryProjectPath
-            : undefined;
+      const { projectPath } = req.body as { projectPath: string };
 
       if (!projectPath) {
         res.status(400).json({ success: false, error: 'projectPath is required' });
@@ -45,23 +33,18 @@ export function createListHandler(
       // We don't await this to keep the list response fast
       // Note: detectOrphanedFeatures handles errors internally and always resolves
       if (autoModeService) {
-        autoModeService
-          .detectOrphanedFeatures(projectPath)
-          .then((orphanedFeatures) => {
-            if (orphanedFeatures.length > 0) {
+        autoModeService.detectOrphanedFeatures(projectPath).then((orphanedFeatures) => {
+          if (orphanedFeatures.length > 0) {
+            logger.info(
+              `[ProjectLoad] Detected ${orphanedFeatures.length} orphaned feature(s) in ${projectPath}`
+            );
+            for (const { feature, missingBranch } of orphanedFeatures) {
               logger.info(
-                `[ProjectLoad] Detected ${orphanedFeatures.length} orphaned feature(s) in ${projectPath}`
+                `[ProjectLoad] Orphaned: ${feature.title || feature.id} - branch "${missingBranch}" no longer exists`
               );
-              for (const { feature, missingBranch } of orphanedFeatures) {
-                logger.info(
-                  `[ProjectLoad] Orphaned: ${feature.title || feature.id} - branch "${missingBranch}" no longer exists`
-                );
-              }
             }
-          })
-          .catch((error) => {
-            logger.warn(`[ProjectLoad] Orphan detection failed for ${projectPath}:`, error);
-          });
+          }
+        });
       }
 
       res.json({ success: true, features });

apps/server/src/routes/features/routes/update.ts

@@ -5,7 +5,6 @@
 import type { Request, Response } from 'express';
 import { FeatureLoader } from '../../../services/feature-loader.js';
 import type { Feature, FeatureStatus } from '@automaker/types';
-import type { EventEmitter } from '../../../lib/events.js';
 import { getErrorMessage, logError } from '../common.js';
 import { createLogger } from '@automaker/utils';
 
@@ -14,7 +13,7 @@ const logger = createLogger('features/update');
 // Statuses that should trigger syncing to app_spec.txt
 const SYNC_TRIGGER_STATUSES: FeatureStatus[] = ['verified', 'completed'];
 
-export function createUpdateHandler(featureLoader: FeatureLoader, events?: EventEmitter) {
+export function createUpdateHandler(featureLoader: FeatureLoader) {
   return async (req: Request, res: Response): Promise<void> => {
     try {
       const {
@@ -41,6 +40,23 @@ export function createUpdateHandler(featureLoader: FeatureLoader, events?: Event
         return;
       }
 
+      // Check for duplicate title if title is being updated
+      if (updates.title && updates.title.trim()) {
+        const duplicate = await featureLoader.findDuplicateTitle(
+          projectPath,
+          updates.title,
+          featureId // Exclude the current feature from duplicate check
+        );
+        if (duplicate) {
+          res.status(409).json({
+            success: false,
+            error: `A feature with title "${updates.title}" already exists`,
+            duplicateFeatureId: duplicate.id,
+          });
+          return;
+        }
+      }
+
       // Get the current feature to detect status changes
       const currentFeature = await featureLoader.get(projectPath, featureId);
       const previousStatus = currentFeature?.status as FeatureStatus | undefined;
@@ -55,18 +71,8 @@ export function createUpdateHandler(featureLoader: FeatureLoader, events?: Event
         preEnhancementDescription
       );
 
-      // Emit completion event and sync to app_spec.txt when status transitions to verified/completed
+      // Trigger sync to app_spec.txt when status changes to verified or completed
       if (newStatus && SYNC_TRIGGER_STATUSES.includes(newStatus) && previousStatus !== newStatus) {
-        events?.emit('feature:completed', {
-          featureId,
-          featureName: updated.title,
-          projectPath,
-          passes: true,
-          message:
-            newStatus === 'verified' ? 'Feature verified manually' : 'Feature completed manually',
-          executionMode: 'manual',
-        });
-
         try {
           const synced = await featureLoader.syncFeatureToAppSpec(projectPath, updated);
           if (synced) {

apps/server/src/routes/fs/index.ts

@@ -19,10 +19,6 @@ import { createBrowseHandler } from './routes/browse.js';
 import { createImageHandler } from './routes/image.js';
 import { createSaveBoardBackgroundHandler } from './routes/save-board-background.js';
 import { createDeleteBoardBackgroundHandler } from './routes/delete-board-background.js';
-import { createBrowseProjectFilesHandler } from './routes/browse-project-files.js';
-import { createCopyHandler } from './routes/copy.js';
-import { createMoveHandler } from './routes/move.js';
-import { createDownloadHandler } from './routes/download.js';
 
 export function createFsRoutes(_events: EventEmitter): Router {
   const router = Router();
@@ -41,10 +37,6 @@ export function createFsRoutes(_events: EventEmitter): Router {
   router.get('/image', createImageHandler());
   router.post('/save-board-background', createSaveBoardBackgroundHandler());
   router.post('/delete-board-background', createDeleteBoardBackgroundHandler());
-  router.post('/browse-project-files', createBrowseProjectFilesHandler());
-  router.post('/copy', createCopyHandler());
-  router.post('/move', createMoveHandler());
-  router.post('/download', createDownloadHandler());
 
   return router;
 }

apps/server/src/routes/fs/routes/browse-project-files.ts

@@ -1,191 +0,0 @@
-/**
- * POST /browse-project-files endpoint - Browse files and directories within a project
- *
- * Unlike /browse which only lists directories (for project folder selection),
- * this endpoint lists both files and directories relative to a project root.
- * Used by the file selector for "Copy files to worktree" settings.
- *
- * Features:
- * - Lists both files and directories
- * - Hides .git, .worktrees, node_modules, and other build artifacts
- * - Returns entries relative to the project root
- * - Supports navigating into subdirectories
- * - Security: prevents path traversal outside project root
- */
-
-import type { Request, Response } from 'express';
-import * as secureFs from '../../../lib/secure-fs.js';
-import path from 'path';
-import { PathNotAllowedError } from '@automaker/platform';
-import { getErrorMessage, logError } from '../common.js';
-
-// Directories to hide from the listing (build artifacts, caches, etc.)
-const HIDDEN_DIRECTORIES = new Set([
-  '.git',
-  '.worktrees',
-  'node_modules',
-  '.automaker',
-  '__pycache__',
-  '.cache',
-  '.next',
-  '.nuxt',
-  '.svelte-kit',
-  '.turbo',
-  '.vercel',
-  '.output',
-  'coverage',
-  '.nyc_output',
-  'dist',
-  'build',
-  'out',
-  '.tmp',
-  'tmp',
-  '.venv',
-  'venv',
-  'target',
-  'vendor',
-  '.gradle',
-  '.idea',
-  '.vscode',
-]);
-
-interface ProjectFileEntry {
-  name: string;
-  relativePath: string;
-  isDirectory: boolean;
-  isFile: boolean;
-}
-
-export function createBrowseProjectFilesHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { projectPath, relativePath } = req.body as {
-        projectPath: string;
-        relativePath?: string; // Relative path within the project to browse (empty = project root)
-      };
-
-      if (!projectPath) {
-        res.status(400).json({ success: false, error: 'projectPath is required' });
-        return;
-      }
-
-      const resolvedProjectPath = path.resolve(projectPath);
-
-      // Determine the target directory to browse
-      let targetPath = resolvedProjectPath;
-      let currentRelativePath = '';
-
-      if (relativePath) {
-        // Security: normalize and validate the relative path
-        const normalized = path.normalize(relativePath);
-        if (normalized.startsWith('..') || path.isAbsolute(normalized)) {
-          res.status(400).json({
-            success: false,
-            error: 'Invalid relative path - must be within the project directory',
-          });
-          return;
-        }
-        targetPath = path.join(resolvedProjectPath, normalized);
-        currentRelativePath = normalized;
-
-        // Double-check the resolved path is within the project
-        // Use a separator-terminated prefix to prevent matching sibling dirs
-        // that share the same prefix (e.g. /projects/foo vs /projects/foobar).
-        const resolvedTarget = path.resolve(targetPath);
-        const projectPrefix = resolvedProjectPath.endsWith(path.sep)
-          ? resolvedProjectPath
-          : resolvedProjectPath + path.sep;
-        if (!resolvedTarget.startsWith(projectPrefix) && resolvedTarget !== resolvedProjectPath) {
-          res.status(400).json({
-            success: false,
-            error: 'Path traversal detected',
-          });
-          return;
-        }
-      }
-
-      // Determine parent relative path
-      let parentRelativePath: string | null = null;
-      if (currentRelativePath) {
-        const parent = path.dirname(currentRelativePath);
-        parentRelativePath = parent === '.' ? '' : parent;
-      }
-
-      try {
-        const stat = await secureFs.stat(targetPath);
-
-        if (!stat.isDirectory()) {
-          res.status(400).json({ success: false, error: 'Path is not a directory' });
-          return;
-        }
-
-        // Read directory contents
-        const dirEntries = await secureFs.readdir(targetPath, { withFileTypes: true });
-
-        // Filter and map entries
-        const entries: ProjectFileEntry[] = dirEntries
-          .filter((entry) => {
-            // Skip hidden directories (build artifacts, etc.)
-            if (entry.isDirectory() && HIDDEN_DIRECTORIES.has(entry.name)) {
-              return false;
-            }
-            // Skip entries starting with . (hidden files) except common config files
-            // We keep hidden files visible since users often need .env, .eslintrc, etc.
-            return true;
-          })
-          .map((entry) => {
-            const entryRelativePath = currentRelativePath
-              ? path.posix.join(currentRelativePath.replace(/\\/g, '/'), entry.name)
-              : entry.name;
-
-            return {
-              name: entry.name,
-              relativePath: entryRelativePath,
-              isDirectory: entry.isDirectory(),
-              isFile: entry.isFile(),
-            };
-          })
-          // Sort: directories first, then files, alphabetically within each group
-          .sort((a, b) => {
-            if (a.isDirectory !== b.isDirectory) {
-              return a.isDirectory ? -1 : 1;
-            }
-            return a.name.localeCompare(b.name);
-          });
-
-        res.json({
-          success: true,
-          currentRelativePath,
-          parentRelativePath,
-          entries,
-        });
-      } catch (error) {
-        const errorMessage = error instanceof Error ? error.message : 'Failed to read directory';
-        const isPermissionError = errorMessage.includes('EPERM') || errorMessage.includes('EACCES');
-
-        if (isPermissionError) {
-          res.json({
-            success: true,
-            currentRelativePath,
-            parentRelativePath,
-            entries: [],
-            warning: 'Permission denied - unable to read this directory',
-          });
-        } else {
-          res.status(400).json({
-            success: false,
-            error: errorMessage,
-          });
-        }
-      }
-    } catch (error) {
-      if (error instanceof PathNotAllowedError) {
-        res.status(403).json({ success: false, error: getErrorMessage(error) });
-        return;
-      }
-
-      logError(error, 'Browse project files failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/fs/routes/copy.ts

@@ -1,99 +0,0 @@
-/**
- * POST /copy endpoint - Copy file or directory to a new location
- */
-
-import type { Request, Response } from 'express';
-import * as secureFs from '../../../lib/secure-fs.js';
-import path from 'path';
-import { PathNotAllowedError } from '@automaker/platform';
-import { mkdirSafe } from '@automaker/utils';
-import { getErrorMessage, logError } from '../common.js';
-
-/**
- * Recursively copy a directory and its contents
- */
-async function copyDirectoryRecursive(src: string, dest: string): Promise<void> {
-  await mkdirSafe(dest);
-  const entries = await secureFs.readdir(src, { withFileTypes: true });
-
-  for (const entry of entries) {
-    const srcPath = path.join(src, entry.name);
-    const destPath = path.join(dest, entry.name);
-
-    if (entry.isDirectory()) {
-      await copyDirectoryRecursive(srcPath, destPath);
-    } else {
-      await secureFs.copyFile(srcPath, destPath);
-    }
-  }
-}
-
-export function createCopyHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { sourcePath, destinationPath, overwrite } = req.body as {
-        sourcePath: string;
-        destinationPath: string;
-        overwrite?: boolean;
-      };
-
-      if (!sourcePath || !destinationPath) {
-        res
-          .status(400)
-          .json({ success: false, error: 'sourcePath and destinationPath are required' });
-        return;
-      }
-
-      // Prevent copying a folder into itself or its own descendant (infinite recursion)
-      const resolvedSrc = path.resolve(sourcePath);
-      const resolvedDest = path.resolve(destinationPath);
-      if (resolvedDest === resolvedSrc || resolvedDest.startsWith(resolvedSrc + path.sep)) {
-        res.status(400).json({
-          success: false,
-          error: 'Cannot copy a folder into itself or one of its own descendants',
-        });
-        return;
-      }
-
-      // Check if destination already exists
-      try {
-        await secureFs.stat(destinationPath);
-        // Destination exists
-        if (!overwrite) {
-          res.status(409).json({
-            success: false,
-            error: 'Destination already exists',
-            exists: true,
-          });
-          return;
-        }
-        // If overwrite is true, remove the existing destination first to avoid merging
-        await secureFs.rm(destinationPath, { recursive: true });
-      } catch {
-        // Destination doesn't exist - good to proceed
-      }
-
-      // Ensure parent directory exists
-      await mkdirSafe(path.dirname(path.resolve(destinationPath)));
-
-      // Check if source is a directory
-      const stats = await secureFs.stat(sourcePath);
-
-      if (stats.isDirectory()) {
-        await copyDirectoryRecursive(sourcePath, destinationPath);
-      } else {
-        await secureFs.copyFile(sourcePath, destinationPath);
-      }
-
-      res.json({ success: true });
-    } catch (error) {
-      if (error instanceof PathNotAllowedError) {
-        res.status(403).json({ success: false, error: getErrorMessage(error) });
-        return;
-      }
-
-      logError(error, 'Copy file failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/fs/routes/download.ts

@@ -1,142 +0,0 @@
-/**
- * POST /download endpoint - Download a file, or GET /download for streaming
- * For folders, creates a zip archive on the fly
- */
-
-import type { Request, Response } from 'express';
-import * as secureFs from '../../../lib/secure-fs.js';
-import path from 'path';
-import { PathNotAllowedError } from '@automaker/platform';
-import { getErrorMessage, logError } from '../common.js';
-import { createReadStream } from 'fs';
-import { execFile } from 'child_process';
-import { promisify } from 'util';
-import { tmpdir } from 'os';
-
-const execFileAsync = promisify(execFile);
-
-/**
- * Get total size of a directory recursively
- */
-async function getDirectorySize(dirPath: string): Promise<number> {
-  let totalSize = 0;
-  const entries = await secureFs.readdir(dirPath, { withFileTypes: true });
-
-  for (const entry of entries) {
-    const entryPath = path.join(dirPath, entry.name);
-    if (entry.isDirectory()) {
-      totalSize += await getDirectorySize(entryPath);
-    } else {
-      const stats = await secureFs.stat(entryPath);
-      totalSize += Number(stats.size);
-    }
-  }
-
-  return totalSize;
-}
-
-export function createDownloadHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { filePath } = req.body as { filePath: string };
-
-      if (!filePath) {
-        res.status(400).json({ success: false, error: 'filePath is required' });
-        return;
-      }
-
-      const stats = await secureFs.stat(filePath);
-      const fileName = path.basename(filePath);
-
-      if (stats.isDirectory()) {
-        // For directories, create a zip archive
-        const dirSize = await getDirectorySize(filePath);
-        const MAX_DIR_SIZE = 100 * 1024 * 1024; // 100MB limit
-
-        if (dirSize > MAX_DIR_SIZE) {
-          res.status(413).json({
-            success: false,
-            error: `Directory is too large to download (${(dirSize / (1024 * 1024)).toFixed(1)}MB). Maximum size is ${MAX_DIR_SIZE / (1024 * 1024)}MB.`,
-            size: dirSize,
-          });
-          return;
-        }
-
-        // Create a temporary zip file
-        const zipFileName = `${fileName}.zip`;
-        const tmpZipPath = path.join(tmpdir(), `automaker-download-${Date.now()}-${zipFileName}`);
-
-        try {
-          // Use system zip command (available on macOS and Linux)
-          // Use execFile to avoid shell injection via user-provided paths
-          await execFileAsync('zip', ['-r', tmpZipPath, fileName], {
-            cwd: path.dirname(filePath),
-            maxBuffer: 50 * 1024 * 1024,
-          });
-
-          const zipStats = await secureFs.stat(tmpZipPath);
-
-          res.setHeader('Content-Type', 'application/zip');
-          res.setHeader('Content-Disposition', `attachment; filename="${zipFileName}"`);
-          res.setHeader('Content-Length', zipStats.size.toString());
-          res.setHeader('X-Directory-Size', dirSize.toString());
-
-          const stream = createReadStream(tmpZipPath);
-          stream.pipe(res);
-
-          stream.on('end', async () => {
-            // Cleanup temp file
-            try {
-              await secureFs.rm(tmpZipPath);
-            } catch {
-              // Ignore cleanup errors
-            }
-          });
-
-          stream.on('error', async (err) => {
-            logError(err, 'Download stream error');
-            try {
-              await secureFs.rm(tmpZipPath);
-            } catch {
-              // Ignore cleanup errors
-            }
-            if (!res.headersSent) {
-              res.status(500).json({ success: false, error: 'Stream error during download' });
-            }
-          });
-        } catch (zipError) {
-          // Cleanup on zip failure
-          try {
-            await secureFs.rm(tmpZipPath);
-          } catch {
-            // Ignore
-          }
-          throw zipError;
-        }
-      } else {
-        // For individual files, stream directly
-        res.setHeader('Content-Type', 'application/octet-stream');
-        res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
-        res.setHeader('Content-Length', stats.size.toString());
-
-        const stream = createReadStream(filePath);
-        stream.pipe(res);
-
-        stream.on('error', (err) => {
-          logError(err, 'Download stream error');
-          if (!res.headersSent) {
-            res.status(500).json({ success: false, error: 'Stream error during download' });
-          }
-        });
-      }
-    } catch (error) {
-      if (error instanceof PathNotAllowedError) {
-        res.status(403).json({ success: false, error: getErrorMessage(error) });
-        return;
-      }
-
-      logError(error, 'Download failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/fs/routes/mkdir.ts

@@ -35,9 +35,9 @@ export function createMkdirHandler() {
           error: 'Path exists and is not a directory',
         });
         return;
-      } catch (statError: unknown) {
+      } catch (statError: any) {
         // ENOENT means path doesn't exist - we should create it
-        if ((statError as NodeJS.ErrnoException).code !== 'ENOENT') {
+        if (statError.code !== 'ENOENT') {
           // Some other error (could be ELOOP in parent path)
           throw statError;
         }
@@ -47,7 +47,7 @@ export function createMkdirHandler() {
       await secureFs.mkdir(resolvedPath, { recursive: true });
 
       res.json({ success: true });
-    } catch (error: unknown) {
+    } catch (error: any) {
       // Path not allowed - return 403 Forbidden
       if (error instanceof PathNotAllowedError) {
         res.status(403).json({ success: false, error: getErrorMessage(error) });
@@ -55,7 +55,7 @@ export function createMkdirHandler() {
       }
 
       // Handle ELOOP specifically
-      if ((error as NodeJS.ErrnoException).code === 'ELOOP') {
+      if (error.code === 'ELOOP') {
         logError(error, 'Create directory failed - symlink loop detected');
         res.status(400).json({
           success: false,

apps/server/src/routes/fs/routes/move.ts

@@ -1,79 +0,0 @@
-/**
- * POST /move endpoint - Move (rename) file or directory to a new location
- */
-
-import type { Request, Response } from 'express';
-import * as secureFs from '../../../lib/secure-fs.js';
-import path from 'path';
-import { PathNotAllowedError } from '@automaker/platform';
-import { mkdirSafe } from '@automaker/utils';
-import { getErrorMessage, logError } from '../common.js';
-
-export function createMoveHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { sourcePath, destinationPath, overwrite } = req.body as {
-        sourcePath: string;
-        destinationPath: string;
-        overwrite?: boolean;
-      };
-
-      if (!sourcePath || !destinationPath) {
-        res
-          .status(400)
-          .json({ success: false, error: 'sourcePath and destinationPath are required' });
-        return;
-      }
-
-      // Prevent moving to same location or into its own descendant
-      const resolvedSrc = path.resolve(sourcePath);
-      const resolvedDest = path.resolve(destinationPath);
-      if (resolvedDest === resolvedSrc) {
-        // No-op: source and destination are the same
-        res.json({ success: true });
-        return;
-      }
-      if (resolvedDest.startsWith(resolvedSrc + path.sep)) {
-        res.status(400).json({
-          success: false,
-          error: 'Cannot move a folder into one of its own descendants',
-        });
-        return;
-      }
-
-      // Check if destination already exists
-      try {
-        await secureFs.stat(destinationPath);
-        // Destination exists
-        if (!overwrite) {
-          res.status(409).json({
-            success: false,
-            error: 'Destination already exists',
-            exists: true,
-          });
-          return;
-        }
-        // If overwrite is true, remove the existing destination first
-        await secureFs.rm(destinationPath, { recursive: true });
-      } catch {
-        // Destination doesn't exist - good to proceed
-      }
-
-      // Ensure parent directory exists
-      await mkdirSafe(path.dirname(path.resolve(destinationPath)));
-
-      // Use rename for the move operation
-      await secureFs.rename(sourcePath, destinationPath);
-
-      res.json({ success: true });
-    } catch (error) {
-      if (error instanceof PathNotAllowedError) {
-        res.status(403).json({ success: false, error: getErrorMessage(error) });
-        return;
-      }
-
-      logError(error, 'Move file failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/fs/routes/resolve-directory.ts

@@ -10,11 +10,7 @@ import { getErrorMessage, logError } from '../common.js';
 export function createResolveDirectoryHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const {
-        directoryName,
-        sampleFiles,
-        fileCount: _fileCount,
-      } = req.body as {
+      const { directoryName, sampleFiles, fileCount } = req.body as {
         directoryName: string;
         sampleFiles?: string[];
         fileCount?: number;

apps/server/src/routes/fs/routes/save-board-background.ts

@@ -11,9 +11,10 @@ import { getBoardDir } from '@automaker/platform';
 export function createSaveBoardBackgroundHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { data, filename, projectPath } = req.body as {
+      const { data, filename, mimeType, projectPath } = req.body as {
         data: string;
         filename: string;
+        mimeType: string;
         projectPath: string;
       };
 

apps/server/src/routes/fs/routes/save-image.ts

@@ -7,14 +7,14 @@ import * as secureFs from '../../../lib/secure-fs.js';
 import path from 'path';
 import { getErrorMessage, logError } from '../common.js';
 import { getImagesDir } from '@automaker/platform';
-import { sanitizeFilename } from '@automaker/utils';
 
 export function createSaveImageHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { data, filename, projectPath } = req.body as {
+      const { data, filename, mimeType, projectPath } = req.body as {
         data: string;
         filename: string;
+        mimeType: string;
         projectPath: string;
       };
 
@@ -39,7 +39,7 @@ export function createSaveImageHandler() {
       // Generate unique filename with timestamp
       const timestamp = Date.now();
       const ext = path.extname(filename) || '.png';
-      const baseName = sanitizeFilename(path.basename(filename, ext), 'image');
+      const baseName = path.basename(filename, ext);
       const uniqueFilename = `${baseName}-${timestamp}${ext}`;
       const filePath = path.join(imagesDir, uniqueFilename);
 

apps/server/src/routes/fs/routes/validate-path.ts

@@ -5,7 +5,7 @@
 import type { Request, Response } from 'express';
 import * as secureFs from '../../../lib/secure-fs.js';
 import path from 'path';
-import { isPathAllowed, getAllowedRootDirectory } from '@automaker/platform';
+import { isPathAllowed, PathNotAllowedError, getAllowedRootDirectory } from '@automaker/platform';
 import { getErrorMessage, logError } from '../common.js';
 
 export function createValidatePathHandler() {

apps/server/src/routes/fs/routes/write.ts

@@ -24,9 +24,7 @@ export function createWriteHandler() {
 
       // Ensure parent directory exists (symlink-safe)
       await mkdirSafe(path.dirname(path.resolve(filePath)));
-      // Default content to empty string if undefined/null to prevent writing
-      // "undefined" as literal text (e.g. when content field is missing from request)
-      await secureFs.writeFile(filePath, content ?? '', 'utf-8');
+      await secureFs.writeFile(filePath, content, 'utf-8');
 
       res.json({ success: true });
     } catch (error) {

apps/server/src/routes/gemini/index.ts

@@ -1,66 +0,0 @@
-import { Router, Request, Response } from 'express';
-import { GeminiProvider } from '../../providers/gemini-provider.js';
-import { GeminiUsageService } from '../../services/gemini-usage-service.js';
-import { createLogger } from '@automaker/utils';
-import type { EventEmitter } from '../../lib/events.js';
-
-const logger = createLogger('Gemini');
-
-export function createGeminiRoutes(
-  usageService: GeminiUsageService,
-  _events: EventEmitter
-): Router {
-  const router = Router();
-
-  // Get current usage/quota data from Google Cloud API
-  router.get('/usage', async (_req: Request, res: Response) => {
-    try {
-      const usageData = await usageService.fetchUsageData();
-
-      res.json(usageData);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : 'Unknown error';
-      logger.error('Error fetching Gemini usage:', error);
-
-      // Return error in a format the UI expects
-      res.status(200).json({
-        authenticated: false,
-        authMethod: 'none',
-        usedPercent: 0,
-        remainingPercent: 100,
-        lastUpdated: new Date().toISOString(),
-        error: `Failed to fetch Gemini usage: ${message}`,
-      });
-    }
-  });
-
-  // Check if Gemini is available
-  router.get('/status', async (_req: Request, res: Response) => {
-    try {
-      const provider = new GeminiProvider();
-      const status = await provider.detectInstallation();
-
-      // Derive authMethod from typed InstallationStatus fields
-      const authMethod = status.authenticated
-        ? status.hasApiKey
-          ? 'api_key'
-          : 'cli_login'
-        : 'none';
-
-      res.json({
-        success: true,
-        installed: status.installed,
-        version: status.version || null,
-        path: status.path || null,
-        authenticated: status.authenticated || false,
-        authMethod,
-        hasCredentialsFile: false,
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : 'Unknown error';
-      res.status(500).json({ success: false, error: message });
-    }
-  });
-
-  return router;
-}

apps/server/src/routes/git/index.ts

@@ -6,22 +6,12 @@ import { Router } from 'express';
 import { validatePathParams } from '../../middleware/validate-paths.js';
 import { createDiffsHandler } from './routes/diffs.js';
 import { createFileDiffHandler } from './routes/file-diff.js';
-import { createStageFilesHandler } from './routes/stage-files.js';
-import { createDetailsHandler } from './routes/details.js';
-import { createEnhancedStatusHandler } from './routes/enhanced-status.js';
 
 export function createGitRoutes(): Router {
   const router = Router();
 
   router.post('/diffs', validatePathParams('projectPath'), createDiffsHandler());
   router.post('/file-diff', validatePathParams('projectPath', 'filePath'), createFileDiffHandler());
-  router.post(
-    '/stage-files',
-    validatePathParams('projectPath', 'files[]'),
-    createStageFilesHandler()
-  );
-  router.post('/details', validatePathParams('projectPath', 'filePath?'), createDetailsHandler());
-  router.post('/enhanced-status', validatePathParams('projectPath'), createEnhancedStatusHandler());
 
   return router;
 }

apps/server/src/routes/git/routes/details.ts

@@ -1,248 +0,0 @@
-/**
- * POST /details endpoint - Get detailed git info for a file or project
- * Returns branch, last commit info, diff stats, and conflict status
- */
-
-import type { Request, Response } from 'express';
-import { exec, execFile } from 'child_process';
-import { promisify } from 'util';
-import * as secureFs from '../../../lib/secure-fs.js';
-import { getErrorMessage, logError } from '../common.js';
-
-const execAsync = promisify(exec);
-const execFileAsync = promisify(execFile);
-
-interface GitFileDetails {
-  branch: string;
-  lastCommitHash: string;
-  lastCommitMessage: string;
-  lastCommitAuthor: string;
-  lastCommitTimestamp: string;
-  linesAdded: number;
-  linesRemoved: number;
-  isConflicted: boolean;
-  isStaged: boolean;
-  isUnstaged: boolean;
-  statusLabel: string;
-}
-
-export function createDetailsHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { projectPath, filePath } = req.body as {
-        projectPath: string;
-        filePath?: string;
-      };
-
-      if (!projectPath) {
-        res.status(400).json({ success: false, error: 'projectPath required' });
-        return;
-      }
-
-      try {
-        // Get current branch
-        const { stdout: branchRaw } = await execAsync('git rev-parse --abbrev-ref HEAD', {
-          cwd: projectPath,
-        });
-        const branch = branchRaw.trim();
-
-        if (!filePath) {
-          // Project-level details - just return branch info
-          res.json({
-            success: true,
-            details: { branch },
-          });
-          return;
-        }
-
-        // Get last commit info for this file
-        let lastCommitHash = '';
-        let lastCommitMessage = '';
-        let lastCommitAuthor = '';
-        let lastCommitTimestamp = '';
-
-        try {
-          const { stdout: logOutput } = await execFileAsync(
-            'git',
-            ['log', '-1', '--format=%H|%s|%an|%aI', '--', filePath],
-            { cwd: projectPath }
-          );
-
-          if (logOutput.trim()) {
-            const parts = logOutput.trim().split('|');
-            lastCommitHash = parts[0] || '';
-            lastCommitMessage = parts[1] || '';
-            lastCommitAuthor = parts[2] || '';
-            lastCommitTimestamp = parts[3] || '';
-          }
-        } catch {
-          // File may not have any commits yet
-        }
-
-        // Get diff stats (lines added/removed)
-        let linesAdded = 0;
-        let linesRemoved = 0;
-
-        try {
-          // Check if file is untracked first
-          const { stdout: statusLine } = await execFileAsync(
-            'git',
-            ['status', '--porcelain', '--', filePath],
-            { cwd: projectPath }
-          );
-
-          if (statusLine.trim().startsWith('??')) {
-            // Untracked file - count all lines as added using Node.js instead of shell
-            try {
-              const fileContent = (await secureFs.readFile(filePath, 'utf-8')).toString();
-              const lines = fileContent.split('\n');
-              // Don't count trailing empty line from final newline
-              linesAdded =
-                lines.length > 0 && lines[lines.length - 1] === ''
-                  ? lines.length - 1
-                  : lines.length;
-            } catch {
-              // Ignore
-            }
-          } else {
-            const { stdout: diffStatRaw } = await execFileAsync(
-              'git',
-              ['diff', '--numstat', 'HEAD', '--', filePath],
-              { cwd: projectPath }
-            );
-
-            if (diffStatRaw.trim()) {
-              const parts = diffStatRaw.trim().split('\t');
-              linesAdded = parseInt(parts[0], 10) || 0;
-              linesRemoved = parseInt(parts[1], 10) || 0;
-            }
-
-            // Also check staged diff stats
-            const { stdout: stagedDiffStatRaw } = await execFileAsync(
-              'git',
-              ['diff', '--numstat', '--cached', '--', filePath],
-              { cwd: projectPath }
-            );
-
-            if (stagedDiffStatRaw.trim()) {
-              const parts = stagedDiffStatRaw.trim().split('\t');
-              linesAdded += parseInt(parts[0], 10) || 0;
-              linesRemoved += parseInt(parts[1], 10) || 0;
-            }
-          }
-        } catch {
-          // Diff might not be available
-        }
-
-        // Get conflict and staging status
-        let isConflicted = false;
-        let isStaged = false;
-        let isUnstaged = false;
-        let statusLabel = '';
-
-        try {
-          const { stdout: statusOutput } = await execFileAsync(
-            'git',
-            ['status', '--porcelain', '--', filePath],
-            { cwd: projectPath }
-          );
-
-          if (statusOutput.trim()) {
-            const indexStatus = statusOutput[0];
-            const workTreeStatus = statusOutput[1];
-
-            // Check for conflicts (both modified, unmerged states)
-            if (
-              indexStatus === 'U' ||
-              workTreeStatus === 'U' ||
-              (indexStatus === 'A' && workTreeStatus === 'A') ||
-              (indexStatus === 'D' && workTreeStatus === 'D')
-            ) {
-              isConflicted = true;
-              statusLabel = 'Conflicted';
-            } else {
-              // Staged changes (index has a status)
-              if (indexStatus !== ' ' && indexStatus !== '?') {
-                isStaged = true;
-              }
-              // Unstaged changes (work tree has a status)
-              if (workTreeStatus !== ' ' && workTreeStatus !== '?') {
-                isUnstaged = true;
-              }
-
-              // Build status label
-              if (isStaged && isUnstaged) {
-                statusLabel = 'Staged + Modified';
-              } else if (isStaged) {
-                statusLabel = 'Staged';
-              } else {
-                const statusChar = workTreeStatus !== ' ' ? workTreeStatus : indexStatus;
-                switch (statusChar) {
-                  case 'M':
-                    statusLabel = 'Modified';
-                    break;
-                  case 'A':
-                    statusLabel = 'Added';
-                    break;
-                  case 'D':
-                    statusLabel = 'Deleted';
-                    break;
-                  case 'R':
-                    statusLabel = 'Renamed';
-                    break;
-                  case 'C':
-                    statusLabel = 'Copied';
-                    break;
-                  case '?':
-                    statusLabel = 'Untracked';
-                    break;
-                  default:
-                    statusLabel = statusChar || '';
-                }
-              }
-            }
-          }
-        } catch {
-          // Status might not be available
-        }
-
-        const details: GitFileDetails = {
-          branch,
-          lastCommitHash,
-          lastCommitMessage,
-          lastCommitAuthor,
-          lastCommitTimestamp,
-          linesAdded,
-          linesRemoved,
-          isConflicted,
-          isStaged,
-          isUnstaged,
-          statusLabel,
-        };
-
-        res.json({ success: true, details });
-      } catch (innerError) {
-        logError(innerError, 'Git details failed');
-        res.json({
-          success: true,
-          details: {
-            branch: '',
-            lastCommitHash: '',
-            lastCommitMessage: '',
-            lastCommitAuthor: '',
-            lastCommitTimestamp: '',
-            linesAdded: 0,
-            linesRemoved: 0,
-            isConflicted: false,
-            isStaged: false,
-            isUnstaged: false,
-            statusLabel: '',
-          },
-        });
-      }
-    } catch (error) {
-      logError(error, 'Get git details failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/git/routes/diffs.ts

@@ -23,7 +23,6 @@ export function createDiffsHandler() {
           diff: result.diff,
           files: result.files,
           hasChanges: result.hasChanges,
-          ...(result.mergeState ? { mergeState: result.mergeState } : {}),
         });
       } catch (innerError) {
         logError(innerError, 'Git diff failed');

apps/server/src/routes/git/routes/enhanced-status.ts

@@ -1,176 +0,0 @@
-/**
- * POST /enhanced-status endpoint - Get enhanced git status with diff stats per file
- * Returns per-file status with lines added/removed and staged/unstaged differentiation
- */
-
-import type { Request, Response } from 'express';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { getErrorMessage, logError } from '../common.js';
-
-const execAsync = promisify(exec);
-
-interface EnhancedFileStatus {
-  path: string;
-  indexStatus: string;
-  workTreeStatus: string;
-  isConflicted: boolean;
-  isStaged: boolean;
-  isUnstaged: boolean;
-  linesAdded: number;
-  linesRemoved: number;
-  statusLabel: string;
-}
-
-function getStatusLabel(indexStatus: string, workTreeStatus: string): string {
-  // Check for conflicts
-  if (
-    indexStatus === 'U' ||
-    workTreeStatus === 'U' ||
-    (indexStatus === 'A' && workTreeStatus === 'A') ||
-    (indexStatus === 'D' && workTreeStatus === 'D')
-  ) {
-    return 'Conflicted';
-  }
-
-  const hasStaged = indexStatus !== ' ' && indexStatus !== '?';
-  const hasUnstaged = workTreeStatus !== ' ' && workTreeStatus !== '?';
-
-  if (hasStaged && hasUnstaged) return 'Staged + Modified';
-  if (hasStaged) return 'Staged';
-
-  const statusChar = workTreeStatus !== ' ' ? workTreeStatus : indexStatus;
-  switch (statusChar) {
-    case 'M':
-      return 'Modified';
-    case 'A':
-      return 'Added';
-    case 'D':
-      return 'Deleted';
-    case 'R':
-      return 'Renamed';
-    case 'C':
-      return 'Copied';
-    case '?':
-      return 'Untracked';
-    default:
-      return statusChar || '';
-  }
-}
-
-export function createEnhancedStatusHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { projectPath } = req.body as { projectPath: string };
-
-      if (!projectPath) {
-        res.status(400).json({ success: false, error: 'projectPath required' });
-        return;
-      }
-
-      try {
-        // Get current branch
-        const { stdout: branchRaw } = await execAsync('git rev-parse --abbrev-ref HEAD', {
-          cwd: projectPath,
-        });
-        const branch = branchRaw.trim();
-
-        // Get porcelain status for all files
-        const { stdout: statusOutput } = await execAsync('git status --porcelain', {
-          cwd: projectPath,
-        });
-
-        // Get diff numstat for working tree changes
-        let workTreeStats: Record<string, { added: number; removed: number }> = {};
-        try {
-          const { stdout: numstatRaw } = await execAsync('git diff --numstat', {
-            cwd: projectPath,
-            maxBuffer: 10 * 1024 * 1024,
-          });
-          for (const line of numstatRaw.trim().split('\n').filter(Boolean)) {
-            const parts = line.split('\t');
-            if (parts.length >= 3) {
-              const added = parseInt(parts[0], 10) || 0;
-              const removed = parseInt(parts[1], 10) || 0;
-              workTreeStats[parts[2]] = { added, removed };
-            }
-          }
-        } catch {
-          // Ignore
-        }
-
-        // Get diff numstat for staged changes
-        let stagedStats: Record<string, { added: number; removed: number }> = {};
-        try {
-          const { stdout: stagedNumstatRaw } = await execAsync('git diff --numstat --cached', {
-            cwd: projectPath,
-            maxBuffer: 10 * 1024 * 1024,
-          });
-          for (const line of stagedNumstatRaw.trim().split('\n').filter(Boolean)) {
-            const parts = line.split('\t');
-            if (parts.length >= 3) {
-              const added = parseInt(parts[0], 10) || 0;
-              const removed = parseInt(parts[1], 10) || 0;
-              stagedStats[parts[2]] = { added, removed };
-            }
-          }
-        } catch {
-          // Ignore
-        }
-
-        // Parse status and build enhanced file list
-        const files: EnhancedFileStatus[] = [];
-
-        for (const line of statusOutput.split('\n').filter(Boolean)) {
-          if (line.length < 4) continue;
-
-          const indexStatus = line[0];
-          const workTreeStatus = line[1];
-          const filePath = line.substring(3).trim();
-
-          // Handle renamed files (format: "R  old -> new")
-          const actualPath = filePath.includes(' -> ')
-            ? filePath.split(' -> ')[1].trim()
-            : filePath;
-
-          const isConflicted =
-            indexStatus === 'U' ||
-            workTreeStatus === 'U' ||
-            (indexStatus === 'A' && workTreeStatus === 'A') ||
-            (indexStatus === 'D' && workTreeStatus === 'D');
-
-          const isStaged = indexStatus !== ' ' && indexStatus !== '?';
-          const isUnstaged = workTreeStatus !== ' ' && workTreeStatus !== '?';
-
-          // Combine diff stats from both working tree and staged
-          const wtStats = workTreeStats[actualPath] || { added: 0, removed: 0 };
-          const stStats = stagedStats[actualPath] || { added: 0, removed: 0 };
-
-          files.push({
-            path: actualPath,
-            indexStatus,
-            workTreeStatus,
-            isConflicted,
-            isStaged,
-            isUnstaged,
-            linesAdded: wtStats.added + stStats.added,
-            linesRemoved: wtStats.removed + stStats.removed,
-            statusLabel: getStatusLabel(indexStatus, workTreeStatus),
-          });
-        }
-
-        res.json({
-          success: true,
-          branch,
-          files,
-        });
-      } catch (innerError) {
-        logError(innerError, 'Git enhanced status failed');
-        res.json({ success: true, branch: '', files: [] });
-      }
-    } catch (error) {
-      logError(error, 'Get enhanced status failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/git/routes/stage-files.ts

@@ -1,67 +0,0 @@
-/**
- * POST /stage-files endpoint - Stage or unstage files in the main project
- */
-
-import type { Request, Response } from 'express';
-import { getErrorMessage, logError } from '../common.js';
-import { stageFiles, StageFilesValidationError } from '../../../services/stage-files-service.js';
-
-export function createStageFilesHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { projectPath, files, operation } = req.body as {
-        projectPath: string;
-        files: string[];
-        operation: 'stage' | 'unstage';
-      };
-
-      if (!projectPath) {
-        res.status(400).json({
-          success: false,
-          error: 'projectPath required',
-        });
-        return;
-      }
-
-      if (!Array.isArray(files) || files.length === 0) {
-        res.status(400).json({
-          success: false,
-          error: 'files array required and must not be empty',
-        });
-        return;
-      }
-
-      for (const file of files) {
-        if (typeof file !== 'string' || file.trim() === '') {
-          res.status(400).json({
-            success: false,
-            error: 'Each element of files must be a non-empty string',
-          });
-          return;
-        }
-      }
-
-      if (operation !== 'stage' && operation !== 'unstage') {
-        res.status(400).json({
-          success: false,
-          error: 'operation must be "stage" or "unstage"',
-        });
-        return;
-      }
-
-      const result = await stageFiles(projectPath, files, operation);
-
-      res.json({
-        success: true,
-        result,
-      });
-    } catch (error) {
-      if (error instanceof StageFilesValidationError) {
-        res.status(400).json({ success: false, error: error.message });
-        return;
-      }
-      logError(error, `${(req.body as { operation?: string })?.operation ?? 'stage'} files failed`);
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/github/index.ts

@@ -9,8 +9,6 @@ import { createCheckGitHubRemoteHandler } from './routes/check-github-remote.js'
 import { createListIssuesHandler } from './routes/list-issues.js';
 import { createListPRsHandler } from './routes/list-prs.js';
 import { createListCommentsHandler } from './routes/list-comments.js';
-import { createListPRReviewCommentsHandler } from './routes/list-pr-review-comments.js';
-import { createResolvePRCommentHandler } from './routes/resolve-pr-comment.js';
 import { createValidateIssueHandler } from './routes/validate-issue.js';
 import {
   createValidationStatusHandler,
@@ -31,16 +29,6 @@ export function createGitHubRoutes(
   router.post('/issues', validatePathParams('projectPath'), createListIssuesHandler());
   router.post('/prs', validatePathParams('projectPath'), createListPRsHandler());
   router.post('/issue-comments', validatePathParams('projectPath'), createListCommentsHandler());
-  router.post(
-    '/pr-review-comments',
-    validatePathParams('projectPath'),
-    createListPRReviewCommentsHandler()
-  );
-  router.post(
-    '/resolve-pr-comment',
-    validatePathParams('projectPath'),
-    createResolvePRCommentHandler()
-  );
   router.post(
     '/validate-issue',
     validatePathParams('projectPath'),

apps/server/src/routes/github/routes/common.ts

@@ -1,14 +1,38 @@
 /**
  * Common utilities for GitHub routes
- *
- * Re-exports shared utilities from lib/exec-utils so route consumers
- * can continue importing from this module unchanged.
  */
 
 import { exec } from 'child_process';
 import { promisify } from 'util';
+import { createLogger } from '@automaker/utils';
+
+const logger = createLogger('GitHub');
 
 export const execAsync = promisify(exec);
 
-// Re-export shared utilities from the canonical location
-export { extendedPath, execEnv, getErrorMessage, logError } from '../../../lib/exec-utils.js';
+// Extended PATH to include common tool installation locations
+export const extendedPath = [
+  process.env.PATH,
+  '/opt/homebrew/bin',
+  '/usr/local/bin',
+  '/home/linuxbrew/.linuxbrew/bin',
+  `${process.env.HOME}/.local/bin`,
+]
+  .filter(Boolean)
+  .join(':');
+
+export const execEnv = {
+  ...process.env,
+  PATH: extendedPath,
+};
+
+export function getErrorMessage(error: unknown): string {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+
+export function logError(error: unknown, context: string): void {
+  logger.error(`${context}:`, error);
+}

apps/server/src/routes/github/routes/list-pr-review-comments.ts

@@ -1,72 +0,0 @@
-/**
- * POST /pr-review-comments endpoint - Fetch review comments for a GitHub PR
- *
- * Fetches both regular PR comments and inline code review comments
- * for a specific pull request, providing file path and line context.
- */
-
-import type { Request, Response } from 'express';
-import { getErrorMessage, logError } from './common.js';
-import { checkGitHubRemote } from './check-github-remote.js';
-import {
-  fetchPRReviewComments,
-  fetchReviewThreadResolvedStatus,
-  type PRReviewComment,
-  type ListPRReviewCommentsResult,
-} from '../../../services/pr-review-comments.service.js';
-
-// Re-export types so existing callers continue to work
-export type { PRReviewComment, ListPRReviewCommentsResult };
-// Re-export service functions so existing callers continue to work
-export { fetchPRReviewComments, fetchReviewThreadResolvedStatus };
-
-interface ListPRReviewCommentsRequest {
-  projectPath: string;
-  prNumber: number;
-}
-
-export function createListPRReviewCommentsHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { projectPath, prNumber } = req.body as ListPRReviewCommentsRequest;
-
-      if (!projectPath) {
-        res.status(400).json({ success: false, error: 'projectPath is required' });
-        return;
-      }
-
-      if (!prNumber || typeof prNumber !== 'number') {
-        res
-          .status(400)
-          .json({ success: false, error: 'prNumber is required and must be a number' });
-        return;
-      }
-
-      // Check if this is a GitHub repo and get owner/repo
-      const remoteStatus = await checkGitHubRemote(projectPath);
-      if (!remoteStatus.hasGitHubRemote || !remoteStatus.owner || !remoteStatus.repo) {
-        res.status(400).json({
-          success: false,
-          error: 'Project does not have a GitHub remote',
-        });
-        return;
-      }
-
-      const comments = await fetchPRReviewComments(
-        projectPath,
-        remoteStatus.owner,
-        remoteStatus.repo,
-        prNumber
-      );
-
-      res.json({
-        success: true,
-        comments,
-        totalCount: comments.length,
-      });
-    } catch (error) {
-      logError(error, 'Fetch PR review comments failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/github/routes/resolve-pr-comment.ts

@@ -1,66 +0,0 @@
-/**
- * POST /resolve-pr-comment endpoint - Resolve or unresolve a GitHub PR review thread
- *
- * Uses the GitHub GraphQL API to resolve or unresolve a review thread
- * identified by its GraphQL node ID (threadId).
- */
-
-import type { Request, Response } from 'express';
-import { getErrorMessage, logError } from './common.js';
-import { checkGitHubRemote } from './check-github-remote.js';
-import { executeReviewThreadMutation } from '../../../services/github-pr-comment.service.js';
-
-export interface ResolvePRCommentResult {
-  success: boolean;
-  isResolved?: boolean;
-  error?: string;
-}
-
-interface ResolvePRCommentRequest {
-  projectPath: string;
-  threadId: string;
-  resolve: boolean;
-}
-
-export function createResolvePRCommentHandler() {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { projectPath, threadId, resolve } = req.body as ResolvePRCommentRequest;
-
-      if (!projectPath) {
-        res.status(400).json({ success: false, error: 'projectPath is required' });
-        return;
-      }
-
-      if (!threadId) {
-        res.status(400).json({ success: false, error: 'threadId is required' });
-        return;
-      }
-
-      if (typeof resolve !== 'boolean') {
-        res.status(400).json({ success: false, error: 'resolve must be a boolean' });
-        return;
-      }
-
-      // Check if this is a GitHub repo
-      const remoteStatus = await checkGitHubRemote(projectPath);
-      if (!remoteStatus.hasGitHubRemote) {
-        res.status(400).json({
-          success: false,
-          error: 'Project does not have a GitHub remote',
-        });
-        return;
-      }
-
-      const result = await executeReviewThreadMutation(projectPath, threadId, resolve);
-
-      res.json({
-        success: true,
-        isResolved: result.isResolved,
-      });
-    } catch (error) {
-      logError(error, 'Resolve PR comment failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/github/routes/validate-issue.ts

@@ -25,7 +25,7 @@ import {
   isOpencodeModel,
   supportsStructuredOutput,
 } from '@automaker/types';
-import { resolvePhaseModel, resolveModelString } from '@automaker/model-resolver';
+import { resolvePhaseModel } from '@automaker/model-resolver';
 import { extractJson } from '../../../lib/json-extractor.js';
 import { writeValidation } from '../../../lib/validation-storage.js';
 import { streamingQuery } from '../../../providers/simple-query-service.js';
@@ -188,12 +188,8 @@ ${basePrompt}`;
       }
     }
 
-    // CRITICAL: For custom providers (GLM, MiniMax), pass the provider's model ID (e.g. "GLM-4.7")
-    // to the API, NOT the resolved Claude model - otherwise we get "model not found"
-    // For standard Claude models, resolve aliases (e.g., 'opus' -> 'claude-opus-4-20250514')
-    const effectiveModel = claudeCompatibleProvider
-      ? (model as string)
-      : providerResolvedModel || resolveModelString(model as string);
+    // Use provider resolved model if available, otherwise use original model
+    const effectiveModel = providerResolvedModel || (model as string);
     logger.info(`Using model: ${effectiveModel}`);
 
     // Use streamingQuery with event callbacks

apps/server/src/routes/github/routes/validation-endpoints.ts

@@ -6,6 +6,7 @@ import type { Request, Response } from 'express';
 import type { EventEmitter } from '../../../lib/events.js';
 import type { IssueValidationEvent } from '@automaker/types';
 import {
+  isValidationRunning,
   getValidationStatus,
   getRunningValidations,
   abortValidation,
@@ -14,6 +15,7 @@ import {
   logger,
 } from './validation-common.js';
 import {
+  readValidation,
   getAllValidations,
   getValidationWithFreshness,
   deleteValidation,

apps/server/src/routes/models/routes/providers.ts

@@ -12,7 +12,7 @@ export function createProvidersHandler() {
       // Get installation status from all providers
       const statuses = await ProviderFactory.checkAllProviders();
 
-      const providers: Record<string, Record<string, unknown>> = {
+      const providers: Record<string, any> = {
         anthropic: {
           available: statuses.claude?.installed || false,
           hasApiKey: !!process.env.ANTHROPIC_API_KEY,

apps/server/src/routes/projects/routes/overview.ts

@@ -173,7 +173,7 @@ export function createOverviewHandler(
           const totalFeatures = features.length;
 
           // Get auto-mode status for this project (main worktree, branchName = null)
-          const autoModeStatus: ProjectAutoModeStatus = await autoModeService.getStatusForProject(
+          const autoModeStatus: ProjectAutoModeStatus = autoModeService.getStatusForProject(
             projectRef.path,
             null
           );

apps/server/src/routes/settings/routes/update-global.ts

@@ -14,7 +14,6 @@ import type { GlobalSettings } from '../../../types/settings.js';
 import { getErrorMessage, logError, logger } from '../common.js';
 import { setLogLevel, LogLevel } from '@automaker/utils';
 import { setRequestLoggingEnabled } from '../../../index.js';
-import { getTerminalService } from '../../../services/terminal-service.js';
 
 /**
  * Map server log level string to LogLevel enum
@@ -46,20 +45,18 @@ export function createUpdateGlobalHandler(settingsService: SettingsService) {
       }
 
       // Minimal debug logging to help diagnose accidental wipes.
-      const projectsLen = Array.isArray(updates.projects) ? updates.projects.length : undefined;
-      const trashedLen = Array.isArray(updates.trashedProjects)
-        ? updates.trashedProjects.length
+      const projectsLen = Array.isArray((updates as any).projects)
+        ? (updates as any).projects.length
+        : undefined;
+      const trashedLen = Array.isArray((updates as any).trashedProjects)
+        ? (updates as any).trashedProjects.length
         : undefined;
       logger.info(
         `[SERVER_SETTINGS_UPDATE] Request received: projects=${projectsLen ?? 'n/a'}, trashedProjects=${trashedLen ?? 'n/a'}, theme=${
-          updates.theme ?? 'n/a'
-        }, localStorageMigrated=${updates.localStorageMigrated ?? 'n/a'}`
+          (updates as any).theme ?? 'n/a'
+        }, localStorageMigrated=${(updates as any).localStorageMigrated ?? 'n/a'}`
       );
 
-      // Get old settings to detect theme changes
-      const oldSettings = await settingsService.getGlobalSettings();
-      const oldTheme = oldSettings?.theme;
-
       logger.info('[SERVER_SETTINGS_UPDATE] Calling updateGlobalSettings...');
       const settings = await settingsService.updateGlobalSettings(updates);
       logger.info(
@@ -67,37 +64,6 @@ export function createUpdateGlobalHandler(settingsService: SettingsService) {
         settings.projects?.length ?? 0
       );
 
-      // Handle theme change - regenerate terminal RC files for all projects
-      if ('theme' in updates && updates.theme && updates.theme !== oldTheme) {
-        const terminalService = getTerminalService(settingsService);
-        const newTheme = updates.theme;
-
-        logger.info(
-          `[TERMINAL_CONFIG] Theme changed from ${oldTheme} to ${newTheme}, regenerating RC files`
-        );
-
-        // Regenerate RC files for all projects with terminal config enabled
-        const projects = settings.projects || [];
-        for (const project of projects) {
-          try {
-            const projectSettings = await settingsService.getProjectSettings(project.path);
-            // Check if terminal config is enabled (global or project-specific)
-            const terminalConfigEnabled =
-              projectSettings.terminalConfig?.enabled !== false &&
-              settings.terminalConfig?.enabled === true;
-
-            if (terminalConfigEnabled) {
-              await terminalService.onThemeChange(project.path, newTheme);
-              logger.info(`[TERMINAL_CONFIG] Regenerated RC files for project: ${project.name}`);
-            }
-          } catch (error) {
-            logger.warn(
-              `[TERMINAL_CONFIG] Failed to regenerate RC files for project ${project.name}: ${error}`
-            );
-          }
-        }
-      }
-
       // Apply server log level if it was updated
       if ('serverLogLevel' in updates && updates.serverLogLevel) {
         const level = LOG_LEVEL_MAP[updates.serverLogLevel];

apps/server/src/routes/setup/routes/auth-claude.ts

@@ -4,9 +4,13 @@
 
 import type { Request, Response } from 'express';
 import { getErrorMessage, logError } from '../common.js';
+import { exec } from 'child_process';
+import { promisify } from 'util';
 import * as fs from 'fs';
 import * as path from 'path';
 
+const execAsync = promisify(exec);
+
 export function createAuthClaudeHandler() {
   return async (_req: Request, res: Response): Promise<void> => {
     try {

apps/server/src/routes/setup/routes/auth-opencode.ts

@@ -4,9 +4,13 @@
 
 import type { Request, Response } from 'express';
 import { logError, getErrorMessage } from '../common.js';
+import { exec } from 'child_process';
+import { promisify } from 'util';
 import * as fs from 'fs';
 import * as path from 'path';
 
+const execAsync = promisify(exec);
+
 export function createAuthOpencodeHandler() {
   return async (_req: Request, res: Response): Promise<void> => {
     try {

apps/server/src/routes/setup/routes/copilot-models.ts

@@ -10,6 +10,9 @@ import type { Request, Response } from 'express';
 import { CopilotProvider } from '../../../providers/copilot-provider.js';
 import { getErrorMessage, logError } from '../common.js';
 import type { ModelDefinition } from '@automaker/types';
+import { createLogger } from '@automaker/utils';
+
+const logger = createLogger('CopilotModelsRoute');
 
 // Singleton provider instance for caching
 let providerInstance: CopilotProvider | null = null;

apps/server/src/routes/setup/routes/opencode-models.ts

@@ -14,6 +14,9 @@ import {
 } from '../../../providers/opencode-provider.js';
 import { getErrorMessage, logError } from '../common.js';
 import type { ModelDefinition } from '@automaker/types';
+import { createLogger } from '@automaker/utils';
+
+const logger = createLogger('OpenCodeModelsRoute');
 
 // Singleton provider instance for caching
 let providerInstance: OpencodeProvider | null = null;

apps/server/src/routes/setup/routes/verify-claude-auth.ts

@@ -6,7 +6,6 @@
 import type { Request, Response } from 'express';
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import { createLogger } from '@automaker/utils';
-import { getClaudeAuthIndicators } from '@automaker/platform';
 import { getApiKey } from '../common.js';
 import {
   createSecureAuthEnv,
@@ -110,7 +109,6 @@ export function createVerifyClaudeAuthHandler() {
       let authenticated = false;
       let errorMessage = '';
       let receivedAnyContent = false;
-      let cleanupEnv: (() => void) | undefined;
 
       // Create secure auth session
       const sessionId = `claude-auth-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
@@ -152,13 +150,13 @@ export function createVerifyClaudeAuthHandler() {
         AuthSessionManager.createSession(sessionId, authMethod || 'api_key', apiKey, 'anthropic');
 
         // Create temporary environment override for SDK call
-        cleanupEnv = createTempEnvOverride(authEnv);
+        const cleanupEnv = createTempEnvOverride(authEnv);
 
         // Run a minimal query to verify authentication
         const stream = query({
           prompt: "Reply with only the word 'ok'",
           options: {
-            model: 'claude-sonnet-4-6',
+            model: 'claude-sonnet-4-20250514',
             maxTurns: 1,
             allowedTools: [],
             abortController,
@@ -195,10 +193,8 @@ export function createVerifyClaudeAuthHandler() {
           }
 
           // Check specifically for assistant messages with text content
-          const msgRecord = msg as Record<string, unknown>;
-          const msgMessage = msgRecord.message as Record<string, unknown> | undefined;
-          if (msg.type === 'assistant' && msgMessage?.content) {
-            const content = msgMessage.content;
+          if (msg.type === 'assistant' && (msg as any).message?.content) {
+            const content = (msg as any).message.content;
             if (Array.isArray(content)) {
               for (const block of content) {
                 if (block.type === 'text' && block.text) {
@@ -314,8 +310,6 @@ export function createVerifyClaudeAuthHandler() {
         }
       } finally {
         clearTimeout(timeoutId);
-        // Restore process.env to its original state
-        cleanupEnv?.();
         // Clean up the auth session
         AuthSessionManager.destroySession(sessionId);
       }
@@ -326,28 +320,9 @@ export function createVerifyClaudeAuthHandler() {
         authMethod,
       });
 
-      // Determine specific auth type for success messages
-      const effectiveAuthMethod = authMethod ?? 'api_key';
-      let authType: 'oauth' | 'api_key' | 'cli' | undefined;
-      if (authenticated) {
-        if (effectiveAuthMethod === 'api_key') {
-          authType = 'api_key';
-        } else if (effectiveAuthMethod === 'cli') {
-          // Check if CLI auth is via OAuth (Claude Code subscription) or generic CLI
-          try {
-            const indicators = await getClaudeAuthIndicators();
-            authType = indicators.credentials?.hasOAuthToken ? 'oauth' : 'cli';
-          } catch {
-            // Fall back to generic CLI if credential check fails
-            authType = 'cli';
-          }
-        }
-      }
-
       res.json({
         success: true,
         authenticated,
-        authType,
         error: errorMessage || undefined,
       });
     } catch (error) {

apps/server/src/routes/terminal/common.ts

@@ -5,6 +5,7 @@
 import { randomBytes } from 'crypto';
 import { createLogger } from '@automaker/utils';
 import type { Request, Response, NextFunction } from 'express';
+import { getTerminalService } from '../../services/terminal-service.js';
 
 const logger = createLogger('Terminal');
 

apps/server/src/routes/terminal/routes/auth.ts

@@ -9,6 +9,7 @@ import {
   generateToken,
   addToken,
   getTokenExpiryMs,
+  getErrorMessage,
 } from '../common.js';
 
 export function createAuthHandler() {

apps/server/src/routes/worktree/common.ts

@@ -2,26 +2,59 @@
  * Common utilities for worktree routes
  */
 
-import {
-  createLogger,
-  isValidBranchName,
-  isValidRemoteName,
-  MAX_BRANCH_NAME_LENGTH,
-} from '@automaker/utils';
+import { createLogger } from '@automaker/utils';
+import { spawnProcess } from '@automaker/platform';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { getErrorMessage as getErrorMessageShared, createLogError } from '../common.js';
 
-// Re-export execGitCommand from the canonical shared module so any remaining
-// consumers that import from this file continue to work.
-export { execGitCommand } from '../../lib/git.js';
-
 const logger = createLogger('Worktree');
 export const execAsync = promisify(exec);
 
-// Re-export git validation utilities from the canonical shared module so
-// existing consumers that import from this file continue to work.
-export { isValidBranchName, isValidRemoteName, MAX_BRANCH_NAME_LENGTH };
+// ============================================================================
+// Secure Command Execution
+// ============================================================================
+
+/**
+ * Execute git command with array arguments to prevent command injection.
+ * Uses spawnProcess from @automaker/platform for secure, cross-platform execution.
+ *
+ * @param args - Array of git command arguments (e.g., ['worktree', 'add', path])
+ * @param cwd - Working directory to execute the command in
+ * @returns Promise resolving to stdout output
+ * @throws Error with stderr message if command fails
+ *
+ * @example
+ * ```typescript
+ * // Safe: no injection possible
+ * await execGitCommand(['branch', '-D', branchName], projectPath);
+ *
+ * // Instead of unsafe:
+ * // await execAsync(`git branch -D ${branchName}`, { cwd });
+ * ```
+ */
+export async function execGitCommand(args: string[], cwd: string): Promise<string> {
+  const result = await spawnProcess({
+    command: 'git',
+    args,
+    cwd,
+  });
+
+  // spawnProcess returns { stdout, stderr, exitCode }
+  if (result.exitCode === 0) {
+    return result.stdout;
+  } else {
+    const errorMessage = result.stderr || `Git command failed with code ${result.exitCode}`;
+    throw new Error(errorMessage);
+  }
+}
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+/** Maximum allowed length for git branch names */
+export const MAX_BRANCH_NAME_LENGTH = 250;
 
 // ============================================================================
 // Extended PATH configuration for Electron apps
@@ -65,6 +98,19 @@ export const execEnv = {
   PATH: extendedPath,
 };
 
+// ============================================================================
+// Validation utilities
+// ============================================================================
+
+/**
+ * Validate branch name to prevent command injection.
+ * Git branch names cannot contain: space, ~, ^, :, ?, *, [, \, or control chars.
+ * We also reject shell metacharacters for safety.
+ */
+export function isValidBranchName(name: string): boolean {
+  return /^[a-zA-Z0-9._\-/]+$/.test(name) && name.length < MAX_BRANCH_NAME_LENGTH;
+}
+
 /**
  * Check if gh CLI is available on the system
  */

apps/server/src/routes/worktree/index.ts

@@ -51,25 +51,9 @@ import {
   createDeleteInitScriptHandler,
   createRunInitScriptHandler,
 } from './routes/init-script.js';
-import { createCommitLogHandler } from './routes/commit-log.js';
 import { createDiscardChangesHandler } from './routes/discard-changes.js';
 import { createListRemotesHandler } from './routes/list-remotes.js';
 import { createAddRemoteHandler } from './routes/add-remote.js';
-import { createStashPushHandler } from './routes/stash-push.js';
-import { createStashListHandler } from './routes/stash-list.js';
-import { createStashApplyHandler } from './routes/stash-apply.js';
-import { createStashDropHandler } from './routes/stash-drop.js';
-import { createCherryPickHandler } from './routes/cherry-pick.js';
-import { createBranchCommitLogHandler } from './routes/branch-commit-log.js';
-import { createGeneratePRDescriptionHandler } from './routes/generate-pr-description.js';
-import { createRebaseHandler } from './routes/rebase.js';
-import { createAbortOperationHandler } from './routes/abort-operation.js';
-import { createContinueOperationHandler } from './routes/continue-operation.js';
-import { createStageFilesHandler } from './routes/stage-files.js';
-import { createCheckChangesHandler } from './routes/check-changes.js';
-import { createSetTrackingHandler } from './routes/set-tracking.js';
-import { createSyncHandler } from './routes/sync.js';
-import { createUpdatePRNumberHandler } from './routes/update-pr-number.js';
 import type { SettingsService } from '../../services/settings-service.js';
 
 export function createWorktreeRoutes(
@@ -87,22 +71,12 @@ export function createWorktreeRoutes(
     '/merge',
     validatePathParams('projectPath'),
     requireValidProject,
-    createMergeHandler(events)
-  );
-  router.post(
-    '/create',
-    validatePathParams('projectPath'),
-    createCreateHandler(events, settingsService)
+    createMergeHandler()
   );
+  router.post('/create', validatePathParams('projectPath'), createCreateHandler(events));
   router.post('/delete', validatePathParams('projectPath', 'worktreePath'), createDeleteHandler());
   router.post('/create-pr', createCreatePRHandler());
   router.post('/pr-info', createPRInfoHandler());
-  router.post(
-    '/update-pr-number',
-    validatePathParams('worktreePath', 'projectPath?'),
-    requireValidWorktree,
-    createUpdatePRNumberHandler()
-  );
   router.post(
     '/commit',
     validatePathParams('worktreePath'),
@@ -127,42 +101,14 @@ export function createWorktreeRoutes(
     requireValidWorktree,
     createPullHandler()
   );
-  router.post(
-    '/sync',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createSyncHandler()
-  );
-  router.post(
-    '/set-tracking',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createSetTrackingHandler()
-  );
-  router.post(
-    '/checkout-branch',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createCheckoutBranchHandler(events)
-  );
-  router.post(
-    '/check-changes',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createCheckChangesHandler()
-  );
+  router.post('/checkout-branch', requireValidWorktree, createCheckoutBranchHandler());
   router.post(
     '/list-branches',
     validatePathParams('worktreePath'),
     requireValidWorktree,
     createListBranchesHandler()
   );
-  router.post(
-    '/switch-branch',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createSwitchBranchHandler(events)
-  );
+  router.post('/switch-branch', requireValidWorktree, createSwitchBranchHandler());
   router.post('/open-in-editor', validatePathParams('worktreePath'), createOpenInEditorHandler());
   router.post(
     '/open-in-terminal',
@@ -241,95 +187,5 @@ export function createWorktreeRoutes(
     createAddRemoteHandler()
   );
 
-  // Commit log route
-  router.post(
-    '/commit-log',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createCommitLogHandler(events)
-  );
-
-  // Stash routes
-  router.post(
-    '/stash-push',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createStashPushHandler(events)
-  );
-  router.post(
-    '/stash-list',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createStashListHandler(events)
-  );
-  router.post(
-    '/stash-apply',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createStashApplyHandler(events)
-  );
-  router.post(
-    '/stash-drop',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createStashDropHandler(events)
-  );
-
-  // Cherry-pick route
-  router.post(
-    '/cherry-pick',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createCherryPickHandler(events)
-  );
-
-  // Generate PR description route
-  router.post(
-    '/generate-pr-description',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createGeneratePRDescriptionHandler(settingsService)
-  );
-
-  // Branch commit log route (get commits from a specific branch)
-  router.post(
-    '/branch-commit-log',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createBranchCommitLogHandler(events)
-  );
-
-  // Rebase route
-  router.post(
-    '/rebase',
-    validatePathParams('worktreePath'),
-    requireValidWorktree,
-    createRebaseHandler(events)
-  );
-
-  // Abort in-progress merge/rebase/cherry-pick
-  router.post(
-    '/abort-operation',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createAbortOperationHandler(events)
-  );
-
-  // Continue in-progress merge/rebase/cherry-pick after resolving conflicts
-  router.post(
-    '/continue-operation',
-    validatePathParams('worktreePath'),
-    requireGitRepoOnly,
-    createContinueOperationHandler(events)
-  );
-
-  // Stage/unstage files route
-  router.post(
-    '/stage-files',
-    validatePathParams('worktreePath', 'files[]'),
-    requireGitRepoOnly,
-    createStageFilesHandler()
-  );
-
   return router;
 }

apps/server/src/routes/worktree/routes/abort-operation.ts

@@ -1,117 +0,0 @@
-/**
- * POST /abort-operation endpoint - Abort an in-progress merge, rebase, or cherry-pick
- *
- * Detects which operation (merge, rebase, or cherry-pick) is in progress
- * and aborts it, returning the repository to a clean state.
- */
-
-import type { Request, Response } from 'express';
-import path from 'path';
-import * as fs from 'fs/promises';
-import { getErrorMessage, logError, execAsync } from '../common.js';
-import type { EventEmitter } from '../../../lib/events.js';
-
-/**
- * Detect what type of conflict operation is currently in progress
- */
-async function detectOperation(
-  worktreePath: string
-): Promise<'merge' | 'rebase' | 'cherry-pick' | null> {
-  try {
-    const { stdout: gitDirRaw } = await execAsync('git rev-parse --git-dir', {
-      cwd: worktreePath,
-    });
-    const gitDir = path.resolve(worktreePath, gitDirRaw.trim());
-
-    const [rebaseMergeExists, rebaseApplyExists, mergeHeadExists, cherryPickHeadExists] =
-      await Promise.all([
-        fs
-          .access(path.join(gitDir, 'rebase-merge'))
-          .then(() => true)
-          .catch(() => false),
-        fs
-          .access(path.join(gitDir, 'rebase-apply'))
-          .then(() => true)
-          .catch(() => false),
-        fs
-          .access(path.join(gitDir, 'MERGE_HEAD'))
-          .then(() => true)
-          .catch(() => false),
-        fs
-          .access(path.join(gitDir, 'CHERRY_PICK_HEAD'))
-          .then(() => true)
-          .catch(() => false),
-      ]);
-
-    if (rebaseMergeExists || rebaseApplyExists) return 'rebase';
-    if (mergeHeadExists) return 'merge';
-    if (cherryPickHeadExists) return 'cherry-pick';
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-export function createAbortOperationHandler(events: EventEmitter) {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const { worktreePath } = req.body as {
-        worktreePath: string;
-      };
-
-      if (!worktreePath) {
-        res.status(400).json({
-          success: false,
-          error: 'worktreePath is required',
-        });
-        return;
-      }
-
-      const resolvedWorktreePath = path.resolve(worktreePath);
-
-      // Detect what operation is in progress
-      const operation = await detectOperation(resolvedWorktreePath);
-
-      if (!operation) {
-        res.status(400).json({
-          success: false,
-          error: 'No merge, rebase, or cherry-pick in progress',
-        });
-        return;
-      }
-
-      // Abort the operation
-      let abortCommand: string;
-      switch (operation) {
-        case 'merge':
-          abortCommand = 'git merge --abort';
-          break;
-        case 'rebase':
-          abortCommand = 'git rebase --abort';
-          break;
-        case 'cherry-pick':
-          abortCommand = 'git cherry-pick --abort';
-          break;
-      }
-
-      await execAsync(abortCommand, { cwd: resolvedWorktreePath });
-
-      // Emit event
-      events.emit('conflict:aborted', {
-        worktreePath: resolvedWorktreePath,
-        operation,
-      });
-
-      res.json({
-        success: true,
-        result: {
-          operation,
-          message: `${operation.charAt(0).toUpperCase() + operation.slice(1)} aborted successfully`,
-        },
-      });
-    } catch (error) {
-      logError(error, 'Abort operation failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/worktree/routes/branch-commit-log.ts

@@ -1,92 +0,0 @@
-/**
- * POST /branch-commit-log endpoint - Get recent commit history for a specific branch
- *
- * Similar to commit-log but allows specifying a branch name to get commits from
- * any branch, not just the currently checked out one. Useful for cherry-pick workflows
- * where you need to browse commits from other branches.
- *
- * The handler only validates input, invokes the service, streams lifecycle events
- * via the EventEmitter, and sends the final JSON response.
- *
- * Note: Git repository validation (isGitRepo, hasCommits) is handled by
- * the requireValidWorktree middleware in index.ts
- */
-
-import type { Request, Response } from 'express';
-import type { EventEmitter } from '../../../lib/events.js';
-import { getErrorMessage, logError } from '../common.js';
-import { getBranchCommitLog } from '../../../services/branch-commit-log-service.js';
-import { isValidBranchName } from '@automaker/utils';
-
-export function createBranchCommitLogHandler(events: EventEmitter) {
-  return async (req: Request, res: Response): Promise<void> => {
-    try {
-      const {
-        worktreePath,
-        branchName,
-        limit = 20,
-      } = req.body as {
-        worktreePath: string;
-        branchName?: string;
-        limit?: number;
-      };
-
-      if (!worktreePath) {
-        res.status(400).json({
-          success: false,
-          error: 'worktreePath required',
-        });
-        return;
-      }
-
-      // Validate branchName before forwarding to execGitCommand.
-      // Reject values that start with '-', contain NUL, contain path-traversal
-      // sequences, or include characters outside the safe whitelist.
-      // An absent branchName is allowed (the service defaults it to HEAD).
-      if (branchName !== undefined && !isValidBranchName(branchName)) {
-        res.status(400).json({
-          success: false,
-          error: 'Invalid branchName: value contains unsafe characters or sequences',
-        });
-        return;
-      }
-
-      // Emit start event so the frontend can observe progress
-      events.emit('branchCommitLog:start', {
-        worktreePath,
-        branchName: branchName || 'HEAD',
-        limit,
-      });
-
-      // Delegate all Git work to the service
-      const result = await getBranchCommitLog(worktreePath, branchName, limit);
-
-      // Emit progress with the number of commits fetched
-      events.emit('branchCommitLog:progress', {
-        worktreePath,
-        branchName: result.branch,
-        commitsLoaded: result.total,
-      });
-
-      // Emit done event
-      events.emit('branchCommitLog:done', {
-        worktreePath,
-        branchName: result.branch,
-        total: result.total,
-      });
-
-      res.json({
-        success: true,
-        result,
-      });
-    } catch (error) {
-      // Emit error event so the frontend can react
-      events.emit('branchCommitLog:error', {
-        error: getErrorMessage(error),
-      });
-
-      logError(error, 'Get branch commit log failed');
-      res.status(500).json({ success: false, error: getErrorMessage(error) });
-    }
-  };
-}

apps/server/src/routes/worktree/routes/branch-tracking.ts

@@ -31,8 +31,8 @@ export async function getTrackedBranches(projectPath: string): Promise<TrackedBr
     const content = (await secureFs.readFile(filePath, 'utf-8')) as string;
     const data: BranchTrackingData = JSON.parse(content);
     return data.branches || [];
-  } catch (error: unknown) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+  } catch (error: any) {
+    if (error.code === 'ENOENT') {
       return [];
     }
     logger.warn('Failed to read tracked branches:', error);