fix: resolve mapper configuration for ToolDefinitionManifest and Workspace

Move ToolDefinitionManifest import out of TYPE_CHECKING in tool_type.py so SQLAlchemy can resolve the string-annotated relationship during mapper configuration. Add Workspace to models/__init__.py (before ToolInstance) so the ToolInstance-Workspace relationship can be resolved. Quality gates: py_compile passed, ruff passed, all mappers configure OK.
2026-06-03 14:24:22 +02:00
265 changed files with 21671 additions and 21768 deletions
@@ -48,8 +48,9 @@ apps/web/dist/
 # OS
 .DS_Store
 Thumbs.db
-
+/.stoneforge/.worktrees/
-# Local runtime state
+# Pi / agent cache
 .atl/
 .pi/
-swap-pane
+.atl/
 .sisyphus/
 .pi-lens/
@@ -90,13 +90,6 @@ Before completion, report:
 Do not claim completion without verification evidence.
 ## Git branch policy
 - **Default working branch:** `dev` — all commits and pushes target `dev` unless the user explicitly requests otherwise.
 - `main` is the stable/production branch; merge to `main` only when explicitly instructed.
 - After committing, push to `origin/dev`.
 - If `dev` does not exist locally, create it from `main` or fetch it from origin.
 ## Git workflow
 ### Branching strategy
@@ -21,7 +21,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **User Settings** - Theme selection, git identity, and preference management
 - **SSH Key Management** - Ed25519 key generation with secure storage
 - **Tool Types** - Built-in development tools (code-server, jupyter-notebook) with custom type support
 - **Config Profiles** - User-owned profile CRUD with includes, mounts, path validation, cycle detection, and default profile selection
 - **Comprehensive Documentation** - Architecture, API, deployment, and development guides
 ### Changed
@@ -1,204 +0,0 @@
 """add config profiles, includes, mounts, and tool instance profile selection
 Revision ID: 0013_add_config_profiles
 Revises: 0012_default_port_req
 Create Date: 2026-05-24 12:00:00.000000
 """
 from collections.abc import Sequence
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects import postgresql
 # revision identifiers, used by Alembic.
 revision: str = "0013_add_config_profiles"
 down_revision: str | None = "0012_default_port_req"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 def _table_exists(table_name: str) -> bool:
    return sa.inspect(op.get_bind()).has_table(table_name)
 def _column_exists(table_name: str, column_name: str) -> bool:
    if not _table_exists(table_name):
        return False
    return column_name in {
        column["name"] for column in sa.inspect(op.get_bind()).get_columns(table_name)
    }
 def _index_exists(table_name: str, index_name: str) -> bool:
    if not _table_exists(table_name):
        return False
    return index_name in {
        index["name"] for index in sa.inspect(op.get_bind()).get_indexes(table_name)
    }
 def _foreign_key_exists(
    table_name: str,
    constrained_columns: list[str],
    referred_table: str,
 ) -> bool:
    if not _table_exists(table_name):
        return False
    for foreign_key in sa.inspect(op.get_bind()).get_foreign_keys(table_name):
        if (
            foreign_key.get("constrained_columns") == constrained_columns
            and foreign_key.get("referred_table") == referred_table
        ):
            return True
    return False
 def upgrade() -> None:
    # Earlier branches may already have created config_profiles. Keep this
    # migration defensive so databases can converge onto the current graph.
    if not _table_exists("config_profiles"):
        op.create_table(
            "config_profiles",
            sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
            sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
            sa.Column("name", sa.String(length=255), nullable=False),
            sa.Column("description", sa.Text(), nullable=True),
            sa.Column(
                "created_at",
                sa.DateTime(timezone=True),
                server_default=sa.text("NOW()"),
                nullable=False,
            ),
            sa.Column(
                "updated_at",
                sa.DateTime(timezone=True),
                server_default=sa.text("NOW()"),
                nullable=False,
            ),
            sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
            sa.PrimaryKeyConstraint("id"),
            sa.UniqueConstraint(
                "user_id", "name", name="uq_config_profiles_user_name"
            ),
        )
    if not _index_exists("config_profiles", "idx_config_profiles_user"):
        op.create_index("idx_config_profiles_user", "config_profiles", ["user_id"])
    if not _table_exists("config_includes"):
        op.create_table(
            "config_includes",
            sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
            sa.Column("profile_id", postgresql.UUID(as_uuid=True), nullable=False),
            sa.Column(
                "included_profile_id", postgresql.UUID(as_uuid=True), nullable=False
            ),
            sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
            sa.Column(
                "created_at",
                sa.DateTime(timezone=True),
                server_default=sa.text("NOW()"),
                nullable=False,
            ),
            sa.Column(
                "updated_at",
                sa.DateTime(timezone=True),
                server_default=sa.text("NOW()"),
                nullable=False,
            ),
            sa.ForeignKeyConstraint(
                ["profile_id"], ["config_profiles.id"], ondelete="CASCADE"
            ),
            sa.ForeignKeyConstraint(
                ["included_profile_id"],
                ["config_profiles.id"],
                ondelete="CASCADE",
            ),
            sa.PrimaryKeyConstraint("id"),
            sa.UniqueConstraint(
                "profile_id", "included_profile_id", name="uq_config_includes_pair"
            ),
        )
    if not _index_exists("config_includes", "idx_config_includes_profile"):
        op.create_index("idx_config_includes_profile", "config_includes", ["profile_id"])
    if not _index_exists("config_includes", "idx_config_includes_included"):
        op.create_index(
            "idx_config_includes_included", "config_includes", ["included_profile_id"]
        )
    if not _table_exists("config_mounts"):
        op.create_table(
            "config_mounts",
            sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
            sa.Column("profile_id", postgresql.UUID(as_uuid=True), nullable=False),
            sa.Column("mount_path", sa.String(length=1024), nullable=False),
            sa.Column("content", sa.Text(), nullable=True),
            sa.Column("source_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
            sa.Column("order_index", sa.Integer(), nullable=False, server_default="0"),
            sa.Column(
                "created_at",
                sa.DateTime(timezone=True),
                server_default=sa.text("NOW()"),
                nullable=False,
            ),
            sa.Column(
                "updated_at",
                sa.DateTime(timezone=True),
                server_default=sa.text("NOW()"),
                nullable=False,
            ),
            sa.ForeignKeyConstraint(
                ["profile_id"], ["config_profiles.id"], ondelete="CASCADE"
            ),
            sa.ForeignKeyConstraint(
                ["source_profile_id"], ["config_profiles.id"], ondelete="SET NULL"
            ),
            sa.PrimaryKeyConstraint("id"),
        )
    if not _index_exists("config_mounts", "idx_config_mounts_profile"):
        op.create_index("idx_config_mounts_profile", "config_mounts", ["profile_id"])
    if not _column_exists("tool_instances", "selected_profile_id"):
        op.add_column(
            "tool_instances",
            sa.Column("selected_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
        )
    if not _foreign_key_exists(
        "tool_instances", ["selected_profile_id"], "config_profiles"
    ):
        op.create_foreign_key(
            "fk_tool_instances_selected_profile",
            "tool_instances",
            "config_profiles",
            ["selected_profile_id"],
            ["id"],
            ondelete="SET NULL",
        )
    if not _index_exists("tool_instances", "idx_tool_instances_selected_profile"):
        op.create_index(
            "idx_tool_instances_selected_profile",
            "tool_instances",
            ["selected_profile_id"],
        )
 def downgrade() -> None:
    # Remove selected_profile_id from tool_instances
    op.drop_index("idx_tool_instances_selected_profile", table_name="tool_instances")
    op.drop_constraint(
        "fk_tool_instances_selected_profile", "tool_instances", type_="foreignkey"
    )
    op.drop_column("tool_instances", "selected_profile_id")
    # Drop config_mounts
    op.drop_index("idx_config_mounts_profile", table_name="config_mounts")
    op.drop_table("config_mounts")
    # Drop config_includes
    op.drop_index("idx_config_includes_included", table_name="config_includes")
    op.drop_index("idx_config_includes_profile", table_name="config_includes")
    op.drop_table("config_includes")
    # Drop config_profiles
    op.drop_index("idx_config_profiles_user", table_name="config_profiles")
    op.drop_table("config_profiles")
@@ -1,180 +0,0 @@
 """add profile resolver fields to config profiles and mounts
 Revision ID: 0014_add_profile_resolver_fields
 Revises: 0013_add_config_profiles
 Create Date: 2026-05-24 14:00:00.000000
 """
 from collections.abc import Sequence
 from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects import postgresql
 # revision identifiers, used by Alembic.
 revision: str = "0014_add_profile_resolver_fields"
 down_revision: str | None = "0013_add_config_profiles"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 def _table_exists(table_name: str) -> bool:
    return sa.inspect(op.get_bind()).has_table(table_name)
 def _column_exists(table_name: str, column_name: str) -> bool:
    if not _table_exists(table_name):
        return False
    return column_name in {
        column["name"] for column in sa.inspect(op.get_bind()).get_columns(table_name)
    }
 def _index_exists(table_name: str, index_name: str) -> bool:
    if not _table_exists(table_name):
        return False
    return index_name in {
        index["name"] for index in sa.inspect(op.get_bind()).get_indexes(table_name)
    }
 def _foreign_key_exists(
    table_name: str,
    constrained_columns: list[str],
    referred_table: str,
 ) -> bool:
    if not _table_exists(table_name):
        return False
    for foreign_key in sa.inspect(op.get_bind()).get_foreign_keys(table_name):
        if (
            foreign_key.get("constrained_columns") == constrained_columns
            and foreign_key.get("referred_table") == referred_table
        ):
            return True
    return False
 def _foreign_key_names_for_column(table_name: str, column_name: str) -> list[str]:
    if not _table_exists(table_name):
        return []
    names: list[str] = []
    for foreign_key in sa.inspect(op.get_bind()).get_foreign_keys(table_name):
        if column_name in foreign_key.get("constrained_columns", []):
            name = foreign_key.get("name")
            if name:
                names.append(name)
    return names
 def upgrade() -> None:
    if not _column_exists("config_profiles", "project_id"):
        op.add_column(
            "config_profiles",
            sa.Column("project_id", postgresql.UUID(as_uuid=True), nullable=True),
        )
    if not _column_exists("config_profiles", "tool_type_id"):
        op.add_column(
            "config_profiles",
            sa.Column("tool_type_id", postgresql.UUID(as_uuid=True), nullable=True),
        )
    if not _column_exists("config_profiles", "environment_variables"):
        op.add_column(
            "config_profiles",
            sa.Column("environment_variables", sa.JSON(), nullable=True),
        )
    if not _column_exists("config_profiles", "start_command"):
        op.add_column(
            "config_profiles",
            sa.Column("start_command", sa.Text(), nullable=True),
        )
    if not _column_exists("config_profiles", "working_directory"):
        op.add_column(
            "config_profiles",
            sa.Column("working_directory", sa.Text(), nullable=True),
        )
    if not _column_exists("config_profiles", "port"):
        op.add_column("config_profiles", sa.Column("port", sa.Integer(), nullable=True))
    if not _column_exists("config_profiles", "is_default"):
        op.add_column(
            "config_profiles",
            sa.Column("is_default", sa.Boolean(), nullable=False, server_default="false"),
        )
    if not _foreign_key_exists("config_profiles", ["project_id"], "projects"):
        op.create_foreign_key(
            "fk_config_profiles_project",
            "config_profiles",
            "projects",
            ["project_id"],
            ["id"],
            ondelete="CASCADE",
        )
    if not _foreign_key_exists("config_profiles", ["tool_type_id"], "tool_types"):
        op.create_foreign_key(
            "fk_config_profiles_tool_type",
            "config_profiles",
            "tool_types",
            ["tool_type_id"],
            ["id"],
            ondelete="CASCADE",
        )
    if not _index_exists("config_profiles", "idx_config_profiles_project"):
        op.create_index("idx_config_profiles_project", "config_profiles", ["project_id"])
    if not _index_exists("config_profiles", "idx_config_profiles_tool_type"):
        op.create_index(
            "idx_config_profiles_tool_type", "config_profiles", ["tool_type_id"]
        )
    if _column_exists("config_mounts", "mount_path") and not _column_exists(
        "config_mounts", "target_path"
    ):
        op.alter_column("config_mounts", "mount_path", new_column_name="target_path")
    if not _column_exists("config_mounts", "mode"):
        op.add_column(
            "config_mounts",
            sa.Column("mode", sa.String(length=10), nullable=False, server_default="rw"),
        )
    if not _column_exists("config_mounts", "files"):
        op.add_column(
            "config_mounts",
            sa.Column("files", sa.JSON(), nullable=True),
        )
    for constraint_name in _foreign_key_names_for_column(
        "config_mounts", "source_profile_id"
    ):
        op.drop_constraint(constraint_name, "config_mounts", type_="foreignkey")
    if _column_exists("config_mounts", "content"):
        op.drop_column("config_mounts", "content")
    if _column_exists("config_mounts", "source_profile_id"):
        op.drop_column("config_mounts", "source_profile_id")
 def downgrade() -> None:
    # Restore config_mounts
    op.add_column(
        "config_mounts",
        sa.Column("source_profile_id", postgresql.UUID(as_uuid=True), nullable=True),
    )
    op.add_column(
        "config_mounts",
        sa.Column("content", sa.Text(), nullable=True),
    )
    op.drop_column("config_mounts", "files")
    op.drop_column("config_mounts", "mode")
    op.alter_column("config_mounts", "target_path", new_column_name="mount_path")
    # Restore config_profiles
    op.drop_index("idx_config_profiles_tool_type", table_name="config_profiles")
    op.drop_index("idx_config_profiles_project", table_name="config_profiles")
    op.drop_constraint(
        "fk_config_profiles_tool_type", "config_profiles", type_="foreignkey"
    )
    op.drop_constraint("fk_config_profiles_project", "config_profiles", type_="foreignkey")
    op.drop_column("config_profiles", "is_default")
    op.drop_column("config_profiles", "port")
    op.drop_column("config_profiles", "working_directory")
    op.drop_column("config_profiles", "start_command")
    op.drop_column("config_profiles", "environment_variables")
    op.drop_column("config_profiles", "tool_type_id")
    op.drop_column("config_profiles", "project_id")
@@ -1,20 +0,0 @@
 """merge profile resolver and workspaces heads
 Revision ID: 86cec91fdb00
 Revises: 0014_add_profile_resolver_fields, 2026_06_01_add_workspaces
 Create Date: 2026-06-03 12:48:36.145702
 """
 # revision identifiers, used by Alembic.
 revision = "86cec91fdb00"
 down_revision = ("0014_add_profile_resolver_fields", "2026_06_01_add_workspaces")
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    pass
 def downgrade() -> None:
    pass
@@ -4,18 +4,11 @@ import time
 from datetime import datetime, timezone
 from typing import Any
-from fastapi import APIRouter, status
+from fastapi import APIRouter
 from pydantic import BaseModel, Field
 from sqlalchemy import text
 from src.config import Settings
 from src.database import SessionLocal
 from src.schemas.health import (
    DatabaseHealth,
    DatabaseHealthResponse,
    DiskHealth,
    HealthChecks,
    HealthResponse,
 )
 router = APIRouter()
@@ -23,6 +16,45 @@ router = APIRouter()
 _start_time = time.time()
 class DatabaseHealth(BaseModel):
    """Database health check result."""
    status: str = Field(description="Database health status", examples=["healthy"])
    response_time_ms: float = Field(description="Query response time in milliseconds", examples=[5.2])
 class DiskHealth(BaseModel):
    """Disk space health check result."""
    status: str = Field(description="Disk health status", examples=["healthy"])
    free_gb: float = Field(description="Free disk space in GB", examples=[45.2])
    total_gb: float = Field(description="Total disk space in GB", examples=[100.0])
 class HealthChecks(BaseModel):
    """Individual health checks."""
    database: DatabaseHealth | None = None
    disk: DiskHealth | None = None
 class HealthResponse(BaseModel):
    """Overall health check response."""
    status: str = Field(description="Overall health status", examples=["healthy"])
    timestamp: str = Field(description="ISO 8601 timestamp", examples=["2026-05-19T12:00:00Z"])
    version: str = Field(description="API version", examples=["0.1.0"])
    checks: HealthChecks = Field(description="Individual health checks")
    uptime_seconds: float = Field(description="Server uptime in seconds", examples=[3600.0])
 class DatabaseHealthResponse(BaseModel):
    """Database-specific health check response."""
    status: str = Field(description="Database health status", examples=["healthy"])
    response_time_ms: float = Field(description="Query response time in milliseconds", examples=[5.2])
@router.get(
    "/health",
    response_model=HealthResponse,
@@ -3,24 +3,47 @@ import shutil
 import uuid
 from fastapi import APIRouter, Depends, HTTPException, Response, status
-from sqlalchemy import select
+from pydantic import BaseModel, ConfigDict
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
-from src.auth.dependencies import get_current_user, get_db_session, get_owned_project
+from src.auth.dependencies import (
    _get_owned_project,
    _get_user,
    get_current_user_id,
    get_db_session,
 )
 from src.models.git_repository import GitRepository
 from src.models.project import Project
 from src.models.ssh_key import SSHKey
-from src.models.user import User
+from src.models.tool_instance import ToolInstance
 from src.schemas.project import (
    ProjectCreate,
    ProjectUpdate,
    ProjectResponse,
    SetDefaultSSHKeyRequest,
 )
 router = APIRouter(prefix="/projects", tags=["projects"])
 class ProjectCreate(BaseModel):
    name: str
    description: str | None = None
 class ProjectUpdate(BaseModel):
    name: str | None = None
    description: str | None = None
 class ProjectResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    name: str
    description: str | None
    owner_id: uuid.UUID
    default_ssh_key_id: uuid.UUID | None
 class SetDefaultSSHKeyRequest(BaseModel):
    ssh_key_id: uuid.UUID
@router.post(
    "",
@@ -31,7 +54,7 @@ router = APIRouter(prefix="/projects", tags=["projects"])
 )
 async def create_project(
    data: ProjectCreate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> Project:
    """Create a new project.
@@ -44,6 +67,7 @@ async def create_project(
    Returns:
        The newly created project.
    """
    user = await _get_user(session, user_id)
    project = Project(
        name=data.name,
        description=data.description,
@@ -58,25 +82,77 @@ async def create_project(
@router.get(
    "",
    response_model=list[ProjectResponse],
    summary="List all projects",
-    description="Retrieve all projects owned by the authenticated user.",
+    description="Retrieve all projects owned by the authenticated user with repositories and workspaces.",
 )
 async def list_projects(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
-) -> list[Project]:
+) -> list[dict]:
    """List all projects for the authenticated user.
-    Args:
+    Returns projects with nested repositories and workspaces for inline display.
        user_id: ID of the authenticated user.
        session: Database session.
    Returns:
        List of projects owned by the user.
    """
-    result = await session.execute(select(Project).where(Project.owner_id == user.id))
+    user = await _get_user(session, user_id)
-    return list(result.scalars().all())
+    result = await session.execute(
        select(Project)
        .where(Project.owner_id == user.id)
        .order_by(Project.created_at.desc())
    )
    projects = result.scalars().all()
    from src.models.workspace import Workspace
    enriched = []
    for project in projects:
        repos_result = await session.execute(
            select(GitRepository).where(GitRepository.project_id == project.id)
        )
        repositories = []
        for repo in repos_result.scalars().all():
            ws_result = await session.execute(
                select(Workspace).where(Workspace.repo_id == repo.id)
            )
            workspaces = []
            for ws in ws_result.scalars().all():
                # Count instances
                inst_result = await session.execute(
                    select(func.count()).where(ToolInstance.workspace_id == ws.id)
                )
                instance_count = inst_result.scalar() or 0
                workspaces.append(
                    {
                        "id": str(ws.id),
                        "name": ws.name,
                        "branch": ws.branch,
                        "status": ws.status,
                        "instance_count": instance_count,
                    }
                )
            repositories.append(
                {
                    "id": str(repo.id),
                    "name": repo.name,
                    "remote_url": repo.remote_url,
                    "workspaces": workspaces,
                }
            )
        enriched.append(
            {
                "id": str(project.id),
                "name": project.name,
                "description": project.description,
                "owner_id": str(project.owner_id),
                "repositories": repositories,
                "created_at": project.created_at.isoformat()
                if project.created_at
                else None,
            }
        )
    return enriched
@router.get(
@@ -87,8 +163,7 @@ async def list_projects(
 )
 async def get_project(
    project_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    project: Project = Depends(get_owned_project),
    session: AsyncSession = Depends(get_db_session),
 ) -> Project:
    """Get a specific project by ID.
@@ -101,8 +176,8 @@ async def get_project(
    Returns:
        The requested project.
    """
-    return project
+    await _get_user(session, user_id)
-
+    return await _get_owned_project(project_id, user_id, session)
@router.patch(
@@ -114,8 +189,7 @@ async def get_project(
 async def update_project(
    project_id: uuid.UUID,
    data: ProjectUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    project: Project = Depends(get_owned_project),
    session: AsyncSession = Depends(get_db_session),
 ) -> Project:
    """Update a project.
@@ -129,6 +203,8 @@ async def update_project(
    Returns:
        The updated project.
    """
    await _get_user(session, user_id)
    project = await _get_owned_project(project_id, user_id, session)
    if data.name is not None:
        project.name = data.name
@@ -148,8 +224,7 @@ async def update_project(
 )
 async def delete_project(
    project_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    project: Project = Depends(get_owned_project),
    session: AsyncSession = Depends(get_db_session),
 ) -> Response:
    """Delete a project and all its repositories.
@@ -162,9 +237,13 @@ async def delete_project(
    Returns:
        Empty response with 204 status code.
    """
    await _get_user(session, user_id)
    project = await _get_owned_project(project_id, user_id, session)
    # Delete repositories from disk and database
-    result = await session.execute(select(GitRepository).where(GitRepository.project_id == project_id))
+    result = await session.execute(
        select(GitRepository).where(GitRepository.project_id == project_id)
    )
    repositories = result.scalars().all()
    for repo in repositories:
        if os.path.exists(repo.path):
@@ -185,8 +264,7 @@ async def delete_project(
 async def set_default_ssh_key(
    project_id: uuid.UUID,
    data: SetDefaultSSHKeyRequest,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    project: Project = Depends(get_owned_project),
    session: AsyncSession = Depends(get_db_session),
 ) -> Project:
    """Set the default SSH key for a project.
@@ -200,6 +278,8 @@ async def set_default_ssh_key(
    Returns:
        The updated project.
    """
    user = await _get_user(session, user_id)
    project = await _get_owned_project(project_id, user_id, session)
    ssh_key = await session.get(SSHKey, data.ssh_key_id)
    if ssh_key is None or ssh_key.user_id != user.id:
@@ -1,3 +1,4 @@
 import base64
 import uuid
 from datetime import datetime
@@ -5,19 +6,17 @@ from cryptography.fernet import Fernet
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
-from src.auth.dependencies import get_current_user, get_db_session
+from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
 from src.config import Settings
 from src.models.ssh_key import SSHKey
 from src.models.user import User
 from src.schemas.ssh_key import SSHKeyCreate, SSHKeyResponse
 router = APIRouter(prefix="/ssh-keys", tags=["ssh-keys"])
 def _get_fernet() -> Fernet:
    """Generate a valid Fernet key from the session secret."""
    import base64
@@ -54,6 +53,36 @@ def generate_ssh_key_pair() -> tuple[str, str]:
    return private_bytes.decode("utf-8"), public_bytes.decode("utf-8")
 class SSHKeyCreate(BaseModel):
    name: str
 class SSHKeyResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    name: str
    public_key: str
    created_at: datetime
 class SignPayloadRequest(BaseModel):
    payload: str
 class SignatureResponse(BaseModel):
    signature: str
 class VerifySignatureRequest(BaseModel):
    payload: str
    signature: str
 class VerifySignatureResponse(BaseModel):
    valid: bool
@router.post(
    "",
    response_model=SSHKeyResponse,
@@ -63,7 +92,7 @@ def generate_ssh_key_pair() -> tuple[str, str]:
 )
 async def create_ssh_key(
    data: SSHKeyCreate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> SSHKey:
    """Create a new SSH key pair.
@@ -76,6 +105,7 @@ async def create_ssh_key(
    Returns:
        The newly created SSH key with public key exposed.
    """
    user = await _get_user(session, user_id)
    private_key, public_key = generate_ssh_key_pair()
    fernet = _get_fernet()
@@ -100,7 +130,7 @@ async def create_ssh_key(
    description="List all SSH keys for the authenticated user.",
 )
 async def list_ssh_keys(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> list[SSHKey]:
    """List all SSH keys for the authenticated user.
@@ -112,6 +142,7 @@ async def list_ssh_keys(
    Returns:
        List of SSH keys owned by the user.
    """
    user = await _get_user(session, user_id)
    result = await session.execute(select(SSHKey).where(SSHKey.user_id == user.id))
    return list(result.scalars().all())
@@ -124,7 +155,7 @@ async def list_ssh_keys(
 )
 async def delete_ssh_key(
    key_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> None:
    """Delete an SSH key.
@@ -137,9 +168,87 @@ async def delete_ssh_key(
    Returns:
        None with 204 status code.
    """
    user = await _get_user(session, user_id)
    ssh_key = await session.get(SSHKey, key_id)
    if ssh_key is None or ssh_key.user_id != user.id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
    await session.delete(ssh_key)
    await session.commit()
@router.post(
    "/{key_id}/sign",
    response_model=SignatureResponse,
    summary="Sign payload",
    description="Sign a payload using the SSH private key.",
 )
 async def sign_payload(
    key_id: uuid.UUID,
    data: SignPayloadRequest,
    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> SignatureResponse:
    """Sign a payload with an SSH key.
    Args:
        key_id: UUID of the SSH key to use for signing.
        data: Sign request containing the payload string.
        user_id: ID of the authenticated user.
        session: Database session.
    Returns:
        Base64-encoded Ed25519 signature.
    """
    user = await _get_user(session, user_id)
    ssh_key = await session.get(SSHKey, key_id)
    if ssh_key is None or ssh_key.user_id != user.id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
    fernet = _get_fernet()
    private_key_pem = fernet.decrypt(ssh_key.private_key_encrypted.encode()).decode()
    private_key = serialization.load_ssh_private_key(
        private_key_pem.encode(), password=None
    )
    signature = private_key.sign(data.payload.encode())
    return SignatureResponse(signature=base64.b64encode(signature).decode())
@router.post(
    "/{key_id}/verify",
    response_model=VerifySignatureResponse,
    summary="Verify signature",
    description="Verify a signature against a payload using the SSH public key.",
 )
 async def verify_signature(
    key_id: uuid.UUID,
    data: VerifySignatureRequest,
    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> VerifySignatureResponse:
    """Verify a signature with an SSH key's public key.
    Args:
        key_id: UUID of the SSH key to use for verification.
        data: Verify request containing payload and base64-encoded signature.
        user_id: ID of the authenticated user.
        session: Database session.
    Returns:
        Whether the signature is valid.
    """
    user = await _get_user(session, user_id)
    ssh_key = await session.get(SSHKey, key_id)
    if ssh_key is None or ssh_key.user_id != user.id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ssh key not found")
    public_key = serialization.load_ssh_public_key(ssh_key.public_key.encode())
    try:
        signature = base64.b64decode(data.signature)
        public_key.verify(signature, data.payload.encode())
        return VerifySignatureResponse(valid=True)
    except Exception:
        return VerifySignatureResponse(valid=False)
@@ -1,65 +1,102 @@
 """WebSocket terminal endpoint for tool instances."""
 import asyncio
 import json
 import logging
 import uuid
 from contextlib import suppress
-from fastapi import APIRouter, Depends, WebSocket
+from fastapi import APIRouter, Depends, HTTPException, WebSocket, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from starlette.websockets import WebSocketDisconnect
-from src.auth.dependencies import get_db_session
+from src.auth.dependencies import get_current_user_id, get_db_session
 from src.models.terminal_session import TerminalSessionModel
 from src.models.tool_instance import ToolInstance
-from src.services.terminal_manager import terminal_manager
+from src.models.tool_type import ToolType
 from src.services.terminal_manager import MaxSessionsExceededError, terminal_manager
 router = APIRouter()
 logger = logging.getLogger(__name__)
 class SessionRef:
    """Mutable reference to a terminal session, allowing updates during reset."""
    def __init__(self, session, slot_session_id: str | None = None):
        self.session = session
        self.slot_session_id = slot_session_id or session.session_id
@router.websocket(
    "/ws/tool-instances/{instance_id}/terminal",
 )
-async def terminal_websocket(
+async def terminal_websocket_default(
    websocket: WebSocket,
    instance_id: str,
    db_session: AsyncSession = Depends(get_db_session),
 ) -> None:
-    """WebSocket endpoint for terminal access to a tool instance.
+    """WebSocket endpoint for terminal access (default session alias).
-    Provides an interactive terminal session inside a running tool instance container.
+    Backward-compatible route that maps to the default session.
-    Supports:
+    """
-    - Auto-reconnection (client reconnects, server spawns new session)
+    await _handle_terminal_websocket(websocket, instance_id, None, db_session)
-    - Heartbeat ping/pong
+
-    - Binary and text input frames
+
-    - Graceful session end notifications
+@router.websocket(
    "/ws/tool-instances/{instance_id}/terminal/{session_id}",
 )
 async def terminal_websocket_specific(
    websocket: WebSocket,
    instance_id: str,
    session_id: str,
    db_session: AsyncSession = Depends(get_db_session),
 ) -> None:
    """WebSocket endpoint for a specific terminal session."""
    await _handle_terminal_websocket(websocket, instance_id, session_id, db_session)
 async def _handle_terminal_websocket(
    websocket: WebSocket,
    instance_id: str,
    target_session_id: str | None,
    db_session: AsyncSession,
 ) -> None:
    """Shared WebSocket handler for terminal sessions.
    Args:
        websocket: The WebSocket connection.
        instance_id: UUID string of the tool instance.
        target_session_id: Specific session ID (slot key). None means default session.
        db_session: Database session.
    Returns:
        None. Communicates via WebSocket messages.
    """
-    logger.info("Terminal WebSocket connection attempt for instance %s", instance_id)
+    logger.debug(
        "Terminal WebSocket connection attempt for instance %s (session=%s)",
        instance_id,
        target_session_id or "default",
    )
    await websocket.accept()
    logger.debug("Terminal WebSocket accepted for instance %s", instance_id)
    try:
        # Parse instance_id
        instance_uuid = uuid.UUID(instance_id)
    except ValueError:
        logger.error("Invalid instance ID: %s", instance_id)
        await websocket.close(code=4001, reason="Invalid instance ID")
        return
    # Authenticate user from session cookie
    user_id = await _get_user_from_websocket(websocket, db_session)
    if user_id is None:
        logger.warning(
-            "Unauthorized terminal access attempt for instance %s",
+            "Unauthorized terminal access attempt for instance %s", instance_id
            instance_id,
        )
        await websocket.close(code=4003, reason="Unauthorized")
        return
    # Get instance and verify ownership
    instance = await db_session.get(ToolInstance, instance_uuid)
    if instance is None:
        logger.warning("Instance %s not found", instance_id)
@@ -85,50 +122,605 @@ async def terminal_websocket(
        await websocket.close(code=4004, reason="Instance not running")
        return
-    logger.info(
+    logger.debug("Terminal auth passed for instance %s, user %s", instance_id, user_id)
-        "Creating terminal session for instance %s (container_id=%s)",
+
-        instance_id,
+    # Verify the container actually exists (may have been removed/recreated)
    from src.services.docker import get_container_status
    container_status = get_container_status(instance.container_id)
    if container_status["status"] == "not_found":
        logger.error(
            "Container %s for instance %s not found (may have been removed)",
            instance.container_id,
            instance_id,
        )
        await websocket.close(
            code=4004, reason="Container not found — restart the tool instance"
        )
        return
    # Fetch tool type to get startup_command
    tool_type = await db_session.get(ToolType, instance.tool_type_id)
    startup_command = tool_type.startup_command if tool_type else None
    if startup_command:
        logger.debug(
            "Using startup command for instance %s: %s",
            instance_id,
            startup_command,
        )
    session = None
    # Get or create terminal session
    try:
        if target_session_id is None:
            # Default session alias
            session = await terminal_manager.get_or_create_session(
                instance_uuid,
                instance.container_id,
                startup_command=startup_command,
            )
            slot_session_id = "default"
        else:
            # Specific session
            session = terminal_manager.get_session(
                instance_id,
                target_session_id,
            )
            if session is None:
                # Session not in memory — may have been lost on server restart.
                # Try to restore from the DB row.
                db_row = await db_session.get(
                    TerminalSessionModel, uuid.UUID(target_session_id)
                )
                if (
                    db_row is not None
                    and db_row.instance_id == instance_uuid
                    and db_row.status != "closed"
                ):
                    logger.info(
                        "Restoring terminal session %s for instance %s from DB",
                        target_session_id,
                        instance_id,
                    )
                    session = await terminal_manager.create_session(
                        instance_uuid,
                        instance.container_id,
-            websocket,
+                        startup_command=startup_command,
                        name=db_row.name,
                        session_id=target_session_id,
                    )
-        logger.info(
+                else:
-            "Terminal session created successfully for instance %s",
+                    logger.warning(
                        "Session %s not found for instance %s",
                        target_session_id,
                        instance_id,
                    )
                    await websocket.close(code=4004, reason="Session not found")
                    return
            # Determine slot key for reset scoping
            key = terminal_manager._find_key_by_internal_id(
                instance_id, session.session_id
            )
            slot_session_id = key[1] if key else target_session_id
        logger.debug(
            "Terminal session ready for instance %s (session_id=%s, slot=%s)",
            instance_id,
            session.session_id,
            slot_session_id,
        )
        # Attach WebSocket to session
        await terminal_manager.attach_websocket(session, websocket)
        logger.debug("WebSocket attached to session for instance %s", instance_id)
        # Send connected status
        await websocket.send_json({"type": "status", "status": "connected"})
        logger.debug("Sent connected status for instance %s", instance_id)
-        # Monitor session health and echo state
+        # Use mutable session reference so loops can survive reset
-        while session.is_alive() and not session.closed:
+        session_ref = SessionRef(session, slot_session_id)
-            # Check echo state periodically
+
-            new_echo_state = await session.check_echo_state()
+        # Start write loop and heartbeat (read is now event-driven in TerminalSession)
-            if new_echo_state is not None:
+        write_task = asyncio.create_task(
-                await websocket.send_json(
+            _write_loop(session_ref, websocket, instance_id)
                    {"type": "set_echo_state", "enabled": new_echo_state},
        )
-            await asyncio.sleep(1.0)
+        heartbeat_task = asyncio.create_task(_heartbeat_loop(websocket))
        logger.debug("Started terminal loops for instance %s", instance_id)
-        # Session ended — determine reason and notify client
+        # Wait for either task to complete (indicating disconnect or error)
-        exit_reason = session.get_exit_reason() or "process_exit"
+        done, pending = await asyncio.wait(
-        await websocket.send_json({"type": "session_ended", "reason": exit_reason})
+            [write_task, heartbeat_task],
-        await websocket.close(code=1000, reason=f"Session ended: {exit_reason}")
+            return_when=asyncio.FIRST_COMPLETED,
        )
-    except Exception:
+        logger.debug(
-        logger.exception(
+            "Terminal loop completed for instance %s, done=%s",
            "Terminal session error for instance %s",
            instance_id,
            len(done),
        )
-        await websocket.close(code=4000, reason="Terminal session error")
+
        # Cancel remaining tasks
        for task in pending:
            task.cancel()
    except WebSocketDisconnect:
        logger.debug("WebSocket disconnected for instance %s", instance_id)
    except Exception as exc:
        logger.error(
            "Terminal session error for instance %s: %s",
            instance_id,
            str(exc),
            exc_info=True,
        )
        with suppress(Exception):
            await websocket.close(code=4000, reason=f"Error: {exc}")
    finally:
        # Detach WebSocket, don't kill session
        with suppress(Exception):
            if session is not None:
                await terminal_manager.detach_websocket(session, websocket)
                logger.debug(
                    "WebSocket detached from session for instance %s", instance_id
                )
 async def _write_loop(session_ref: SessionRef, websocket, instance_id: str) -> None:
    """Read input from WebSocket and send to container."""
    try:
        while True:
            session = session_ref.session
            if not session.is_alive() or session._closed:
                await asyncio.sleep(0.1)
                continue
            message = await websocket.receive()
            if message["type"] == "websocket.receive":
                if "bytes" in message:
                    await session.write_input(message["bytes"])
                elif "text" in message:
                    text = message["text"]
                    if text.startswith("{"):
                        # Control message (JSON)
                        try:
                            ctrl = json.loads(text)
                            msg_type = ctrl.get("type")
                            if msg_type == "resize":
                                cols = ctrl.get("cols", 80)
                                rows = ctrl.get("rows", 24)
                                logger.debug(
                                    "Received resize message for instance %s: %sx%s",
                                    instance_id,
                                    cols,
                                    rows,
                                )
                                await session.resize(cols, rows)
                            elif msg_type == "ack":
                                char_count = ctrl.get("chars", 0)
                                if char_count > 0:
                                    session.acknowledge_data(char_count)
                            elif msg_type == "reset":
                                # Reset terminal session (scoped to current slot)
                                logger.debug(
                                    "Resetting terminal session for instance %s (slot=%s)",
                                    session.instance_id,
                                    session_ref.slot_session_id,
                                )
                                await websocket.send_json(
                                    {"type": "status", "status": "resetting"}
                                )
                                # Reset the session scoped to its slot
                                new_session = await terminal_manager.reset_session(
                                    session.instance_id,
                                    session.container_id,
                                    startup_command=session.startup_command,
                                    session_id=session_ref.slot_session_id,
                                    name=session.name,
                                )
                                # Update the mutable session reference
                                session_ref.session = new_session
                                # Attach to new session
                                await terminal_manager.attach_websocket(
                                    new_session, websocket
                                )
                                await websocket.send_json(
                                    {"type": "status", "status": "connected"}
                                )
                                # Continue the loop with the new session
                                continue
                        except json.JSONDecodeError:
                            # Not a valid JSON control message, treat as regular input
                            await session.write_input(text.encode("utf-8"))
                    else:
                        await session.write_input(text.encode("utf-8"))
            elif message["type"] == "websocket.disconnect":
                break
    except Exception:
        pass
 async def _heartbeat_loop(websocket: WebSocket) -> None:
    """Send periodic ping messages to detect disconnections."""
    try:
        while True:
            await asyncio.sleep(30)  # Ping every 30 seconds
            try:
                await websocket.send_json({"type": "ping"})
            except Exception:
                # WebSocket is closed or broken
                break
    except Exception:
        pass
 async def _get_terminal_instance(
    instance_id: uuid.UUID,
    user_id: uuid.UUID,
    db_session: AsyncSession,
 ) -> ToolInstance:
    """Fetch instance and validate auth, ownership, and running status.
    Args:
        instance_id: UUID of the tool instance.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        The validated ToolInstance.
    Raises:
        HTTPException: If instance not found, not owned, or not running.
    """
    instance = await db_session.get(ToolInstance, instance_id)
    if instance is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="Instance not found"
        )
    if instance.owner_id != user_id:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Not authorized to access this instance",
        )
    if instance.status != "running" or not instance.container_id:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST, detail="Instance is not running"
        )
    return instance
@router.get(
    "/instances/{instance_id}/terminal/sessions",
    summary="List terminal sessions",
    description="List terminal sessions for a tool instance with live WebSocket state.",
 )
 async def list_terminal_sessions(
    instance_id: uuid.UUID,
    user_id: uuid.UUID = Depends(get_current_user_id),
    db_session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """List terminal sessions for an instance.
    Args:
        instance_id: UUID of the tool instance.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        Dictionary with sessions list.
    """
    await _get_terminal_instance(instance_id, user_id, db_session)
    # Query active DB rows for this instance
    result = await db_session.execute(
        select(TerminalSessionModel)
        .where(TerminalSessionModel.instance_id == instance_id)
        .where(TerminalSessionModel.status != "closed")
        .order_by(TerminalSessionModel.created_at.asc())
    )
    db_rows = result.scalars().all()
    # Build response with live has_websockets flag.
    # Include DB rows even without in-memory counterparts (e.g. after
    # server restart) so the frontend can display tabs and reconnect.
    sessions = []
    for row in db_rows:
        live_session = terminal_manager.get_session(str(instance_id), str(row.id))
        sessions.append(
            {
                "id": str(row.id),
                "name": row.name,
                "status": row.status,
                "has_websockets": live_session.has_websockets()
                if live_session
                else False,
                "created_at": row.created_at.isoformat() if row.created_at else None,
                "last_activity_at": row.last_activity_at.isoformat()
                if row.last_activity_at
                else None,
            }
        )
    return {"sessions": sessions}
@router.post(
    "/instances/{instance_id}/terminal/sessions",
    summary="Create terminal session",
    description="Create a new terminal session for a running tool instance.",
    status_code=status.HTTP_201_CREATED,
 )
 async def create_terminal_session(
    instance_id: uuid.UUID,
    data: dict,
    user_id: uuid.UUID = Depends(get_current_user_id),
    db_session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Create a new terminal session.
    Args:
        instance_id: UUID of the tool instance.
        data: Request body with optional name.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        Dictionary with new session details.
    Raises:
        HTTPException: 409 if max sessions reached.
    """
    instance = await _get_terminal_instance(instance_id, user_id, db_session)
    assert instance.container_id is not None
    # Fetch tool type to get startup_command
    tool_type = await db_session.get(ToolType, instance.tool_type_id)
    startup_command = tool_type.startup_command if tool_type else None
    name = data.get("name")
    try:
        session = await terminal_manager.create_session(
            instance_id,
            instance.container_id,
            startup_command=startup_command,
            name=name,
        )
    except MaxSessionsExceededError:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="Maximum of 5 terminal sessions reached for this instance",
        ) from None
    return {
        "id": session.session_id,
        "name": session.name,
        "status": session.status,
        "created_at": session.last_activity,
    }
@router.delete(
    "/instances/{instance_id}/terminal/sessions/{session_id}",
    summary="Close terminal session",
    description="Close a specific terminal session.",
 )
 async def close_terminal_session(
    instance_id: uuid.UUID,
    session_id: str,
    user_id: uuid.UUID = Depends(get_current_user_id),
    db_session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Close a terminal session.
    Args:
        instance_id: UUID of the tool instance.
        session_id: ID of the session to close.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        Dictionary with closure status.
    """
    await _get_terminal_instance(instance_id, user_id, db_session)
    # Find the session by internal ID to determine its slot key
    key = terminal_manager._find_key_by_internal_id(str(instance_id), session_id)
    if (
        key is None
        and terminal_manager.get_session(str(instance_id), session_id) is not None
    ):
        key = (str(instance_id), session_id)
    if key is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="Session not found"
        )
    await terminal_manager.close_session(key[0], key[1])
    return {"status": "closed", "session_id": session_id}
@router.post(
    "/instances/{instance_id}/terminal/sessions/{session_id}/reset",
    summary="Reset terminal session",
    description="Reset a specific terminal session, killing the current shell and starting fresh.",
 )
 async def reset_specific_terminal_session(
    instance_id: uuid.UUID,
    session_id: str,
    user_id: uuid.UUID = Depends(get_current_user_id),
    db_session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Reset a specific terminal session.
    Args:
        instance_id: UUID of the tool instance.
        session_id: ID of the session to reset.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        Dictionary with reset session details.
    """
    instance = await _get_terminal_instance(instance_id, user_id, db_session)
    assert instance.container_id is not None
    # Determine slot key for reset
    key = terminal_manager._find_key_by_internal_id(str(instance_id), session_id)
    if (
        key is None
        and terminal_manager.get_session(str(instance_id), session_id) is not None
    ):
        key = (str(instance_id), session_id)
    if key is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="Session not found"
        )
    # Fetch tool type to get startup_command
    tool_type = await db_session.get(ToolType, instance.tool_type_id)
    startup_command = tool_type.startup_command if tool_type else None
    # Preserve name if possible
    live_session = terminal_manager.get_session(str(instance_id), session_id)
    name = live_session.name if live_session else None
    new_session = await terminal_manager.reset_session(
        instance_id,
        instance.container_id,
        startup_command=startup_command,
        session_id=key[1],
        name=name,
    )
    return {
        "id": new_session.session_id,
        "name": new_session.name,
        "status": new_session.status,
    }
@router.post(
    "/instances/{instance_id}/terminal/sessions/{session_id}/rename",
    summary="Rename terminal session",
    description="Rename a specific terminal session.",
 )
 async def rename_terminal_session(
    instance_id: uuid.UUID,
    session_id: str,
    data: dict,
    user_id: uuid.UUID = Depends(get_current_user_id),
    db_session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Rename a terminal session.
    Args:
        instance_id: UUID of the tool instance.
        session_id: ID of the session to rename.
        data: Request body with new name.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        Dictionary with updated session details.
    """
    await _get_terminal_instance(instance_id, user_id, db_session)
    new_name = data.get("name")
    if not new_name or not isinstance(new_name, str):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST, detail="Name is required"
        )
    # Update in-memory session name if live
    live_session = terminal_manager.get_session(str(instance_id), session_id)
    if live_session:
        live_session.name = new_name
    # Update DB row
    db_row = await db_session.get(TerminalSessionModel, uuid.UUID(session_id))
    if db_row is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND, detail="Session not found"
        )
    db_row.name = new_name
    await db_session.commit()
    return {"id": str(db_row.id), "name": new_name}
@router.post(
    "/instances/{instance_id}/terminal/reset",
    summary="Reset terminal session (legacy alias)",
    description="Reset the default terminal session for a tool instance. Preserved for backward compatibility.",
 )
 async def reset_terminal_session(
    instance_id: uuid.UUID,
    user_id: uuid.UUID = Depends(get_current_user_id),
    db_session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Reset the default terminal session for an instance (legacy alias).
    Args:
        instance_id: UUID of the tool instance.
        user_id: ID of the authenticated user.
        db_session: Database session.
    Returns:
        Dictionary with status message.
    """
    instance = await _get_terminal_instance(instance_id, user_id, db_session)
    assert instance.container_id is not None
    # Fetch tool type to get startup_command
    tool_type = await db_session.get(ToolType, instance.tool_type_id)
    startup_command = tool_type.startup_command if tool_type else None
    try:
        # Reset the default session
        new_session = await terminal_manager.reset_session(
            instance_id,
            instance.container_id,
            startup_command=startup_command,
        )
        logger.info(
            "Terminal session reset for instance %s (new session_id=%s)",
            instance_id,
            new_session.session_id,
        )
        return {
            "status": "success",
            "message": "Terminal session reset successfully",
            "instance_id": str(instance_id),
            "session_id": new_session.session_id,
        }
    except Exception as exc:
        logger.error(
            "Failed to reset terminal session for instance %s: %s",
            instance_id,
            str(exc),
            exc_info=True,
        )
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Failed to reset terminal session: {exc}",
        ) from exc
 async def _get_user_from_websocket(
    websocket: WebSocket,
    db_session: AsyncSession,
@@ -141,7 +733,6 @@ async def _get_user_from_websocket(
    Returns:
        The user's UUID if authenticated, None otherwise.
    """
    from src.auth.session import decode_session_cookie
    from src.config import Settings
@@ -1,19 +1,19 @@
 import uuid
 from datetime import datetime
 import yaml
 from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
-from src.auth.dependencies import get_current_user, get_db_session
+from src.api.tool_types_validation import (
    check_port_exposed,
    validate_compose_yaml,
    validate_required_variables,
 )
 from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
 from src.models.tool_type import ToolType
 from src.models.user import User
 from src.schemas.tool_type import (
    ToolTypeCreate,
    ToolTypeResponse,
    ToolTypeUpdate,
    ToolTypeValidateRequest,
 )
 router = APIRouter(prefix="/tool-types", tags=["tool-types"])
@@ -29,6 +29,237 @@ async def _require_admin(user: User) -> None:
    pass
 class ToolTypeCreate(BaseModel):
    name: str
    display_name: str
    description: str | None = None
    default_port: int = 0
    definition_type: str = "compose"
    manifest_id: uuid.UUID | None = None
    compose_template: str | None = None
    dockerfile_template: str | None = None
    build_context: dict | None = None
    readiness_probe: dict | None = None
    startup_command: str | None = None
    required_variables: list[str] = []
    category: str = "other"
    interface_type: str = "web"
    requires_port: bool = True
    @field_validator("definition_type")
    @classmethod
    def validate_definition_type(cls, v: str) -> str:
        if v not in ("compose", "dockerfile", "manifest"):
            raise ValueError(
                "definition_type must be 'compose', 'dockerfile', or 'manifest'"
            )
        return v
    @field_validator("compose_template")
    @classmethod
    def validate_compose_template(cls, v: str | None, info) -> str | None:
        data = info.data
        if data.get("definition_type") != "compose":
            return v
        if v is None or not v.strip():
            raise ValueError(
                "compose_template is required when definition_type is 'compose'"
            )
        validate_compose_yaml(v)
        return v
    @field_validator("dockerfile_template")
    @classmethod
    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
        data = info.data
        if data.get("definition_type") != "dockerfile":
            return v
        if v is None or not v.strip():
            raise ValueError(
                "dockerfile_template is required when definition_type is 'dockerfile'"
            )
        if not v.strip().startswith("FROM"):
            raise ValueError("Dockerfile must start with a FROM instruction")
        return v
    @field_validator("interface_type")
    @classmethod
    def validate_interface_type(cls, v: str) -> str:
        if v not in ("web", "terminal"):
            raise ValueError("interface_type must be 'web' or 'terminal'")
        return v
    @field_validator("default_port")
    @classmethod
    def validate_default_port(cls, v: int, info) -> int:
        data = info.data
        requires_port = data.get("requires_port", True)
        if not requires_port:
            return v
        if v <= 0 or v > 65535:
            raise ValueError("Port must be between 1 and 65535")
        return v
    @field_validator("required_variables")
    @classmethod
    def validate_required_variables(cls, v: list[str], info) -> list[str]:
        if not v:
            return v
        data = info.data
        if data.get("definition_type") != "compose":
            return v
        template = data.get("compose_template")
        if not template:
            return v
        for var in v:
            placeholder = f"{{{{{var}}}}}"
            if placeholder not in template:
                raise ValueError(
                    f"Required variable '{var}' not found in compose template"
                )
        return v
    @model_validator(mode="after")
    def validate_templates(self) -> "ToolTypeCreate":
        if self.definition_type == "manifest":
            if self.manifest_id is None:
                raise ValueError(
                    "manifest_id is required when definition_type is 'manifest'"
                )
            return self
        if self.definition_type == "dockerfile" and (
            self.dockerfile_template is None or not self.dockerfile_template.strip()
        ):
            raise ValueError(
                "dockerfile_template is required when definition_type is 'dockerfile'"
            )
        if self.definition_type == "compose" and (
            self.compose_template is None or not self.compose_template.strip()
        ):
            raise ValueError(
                "compose_template is required when definition_type is 'compose'"
            )
        # Validate that default_port is exposed in compose template (only if requires_port)
        if (
            self.requires_port
            and self.definition_type == "compose"
            and self.compose_template
        ):
            try:
                parsed = validate_compose_yaml(self.compose_template)
            except ValueError:
                return self
            if not check_port_exposed(parsed, self.default_port):
                raise ValueError(
                    f"Port {self.default_port} is not exposed in the compose template. Add it to the 'ports' section."
                )
        return self
 class ToolTypeUpdate(BaseModel):
    display_name: str | None = None
    description: str | None = None
    default_port: int | None = None
    definition_type: str | None = None
    manifest_id: uuid.UUID | None = None
    compose_template: str | None = None
    dockerfile_template: str | None = None
    build_context: dict | None = None
    readiness_probe: dict | None = None
    startup_command: str | None = None
    required_variables: list[str] | None = None
    category: str | None = None
    interface_type: str | None = None
    requires_port: bool | None = None
    @field_validator("definition_type")
    @classmethod
    def validate_definition_type(cls, v: str | None) -> str | None:
        if v is None:
            return v
        if v not in ("compose", "dockerfile", "manifest"):
            raise ValueError(
                "definition_type must be 'compose', 'dockerfile', or 'manifest'"
            )
        return v
    @field_validator("interface_type")
    @classmethod
    def validate_interface_type(cls, v: str | None) -> str | None:
        if v is None:
            return v
        if v not in ("web", "terminal"):
            raise ValueError("interface_type must be 'web' or 'terminal'")
        return v
    @field_validator("compose_template")
    @classmethod
    def validate_compose_template(cls, v: str | None, info) -> str | None:
        if v is None:
            return v
        data = info.data
        definition_type = data.get("definition_type")
        if definition_type and definition_type != "compose":
            return v
        validate_compose_yaml(v)
        return v
    @field_validator("dockerfile_template")
    @classmethod
    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
        if v is None:
            return v
        data = info.data
        definition_type = data.get("definition_type")
        if definition_type and definition_type != "dockerfile":
            return v
        if not v.strip().startswith("FROM"):
            raise ValueError("Dockerfile must start with a FROM instruction")
        return v
 class ToolTypeResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    name: str
    display_name: str
    description: str | None
    category: str
    interface_type: str
    requires_port: bool
    default_port: int
    definition_type: str
    manifest_id: uuid.UUID | None
    compose_template: str | None
    dockerfile_template: str | None
    build_context: dict | None
    readiness_probe: dict | None
    startup_command: str | None
    required_variables: list[str]
    created_by_id: uuid.UUID | None
    created_at: datetime
    updated_at: datetime
@router.post(
    "",
    response_model=ToolTypeResponse,
@@ -38,7 +269,7 @@ async def _require_admin(user: User) -> None:
 )
 async def create_tool_type(
    data: ToolTypeCreate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> ToolType:
    """Create a new tool type.
@@ -51,6 +282,7 @@ async def create_tool_type(
    Returns:
        The newly created tool type.
    """
    user = await _get_user(session, user_id)
    await _require_admin(user)
    # Check for duplicate name
@@ -67,13 +299,16 @@ async def create_tool_type(
        description=data.description,
        default_port=data.default_port,
        definition_type=data.definition_type,
        manifest_id=data.manifest_id,
        compose_template=data.compose_template,
        dockerfile_template=data.dockerfile_template,
        build_context=data.build_context,
        readiness_probe=data.readiness_probe,
        startup_command=data.startup_command,
        required_variables=data.required_variables,
        category=data.category,
-        interfaces=data.interfaces,
+        interface_type=data.interface_type,
        requires_port=data.requires_port,
        created_by_id=user.id,
    )
    session.add(tool_type)
@@ -89,7 +324,7 @@ async def create_tool_type(
    description="List all available tool types including built-in and custom ones.",
 )
 async def list_tool_types(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> list[ToolType]:
    """List all tool types.
@@ -101,6 +336,7 @@ async def list_tool_types(
    Returns:
        List of all tool types ordered by name.
    """
    await _get_user(session, user_id)
    result = await session.execute(select(ToolType).order_by(ToolType.name))
    return list(result.scalars().all())
@@ -113,7 +349,7 @@ async def list_tool_types(
 )
 async def get_tool_type(
    tool_type_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> ToolType:
    """Get a specific tool type by ID.
@@ -126,6 +362,7 @@ async def get_tool_type(
    Returns:
        The requested tool type.
    """
    await _get_user(session, user_id)
    tool_type = await session.get(ToolType, tool_type_id)
    if tool_type is None:
        raise HTTPException(
@@ -143,7 +380,7 @@ async def get_tool_type(
 async def update_tool_type(
    tool_type_id: uuid.UUID,
    data: ToolTypeUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> ToolType:
    """Update a tool type.
@@ -157,6 +394,7 @@ async def update_tool_type(
    Returns:
        The updated tool type.
    """
    user = await _get_user(session, user_id)
    await _require_admin(user)
    tool_type = await session.get(ToolType, tool_type_id)
@@ -165,16 +403,13 @@ async def update_tool_type(
            status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
        )
-    if tool_type.is_builtin:
+    # Built-in tool types can now be modified
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="cannot modify built-in tool types",
        )
    update_data = data.model_dump(exclude_unset=True)
    # Validate port if being updated
-    if "default_port" in update_data:
+    requires_port = update_data.get("requires_port", tool_type.requires_port)
    if "default_port" in update_data and requires_port:
        new_port = update_data["default_port"]
        if new_port <= 0 or new_port > 65535:
            raise HTTPException(
@@ -188,62 +423,35 @@ async def update_tool_type(
            template = update_data.get("compose_template", tool_type.compose_template)
            if template:
                try:
-                    parsed = yaml.safe_load(template)
+                    parsed = validate_compose_yaml(template)
-                except yaml.YAMLError:
+                    if not check_port_exposed(parsed, new_port):
                    parsed = None
                if parsed and isinstance(parsed, dict) and "services" in parsed:
                    port_str = str(new_port)
                    port_exposed = False
                    for service_config in parsed["services"].values():
                        if (
                            isinstance(service_config, dict)
                            and "ports" in service_config
                        ):
                            for port_mapping in service_config["ports"]:
                                if (
                                    isinstance(port_mapping, str)
                                    and port_str in port_mapping
                                ):
                                    port_exposed = True
                                    break
                                elif (
                                    isinstance(port_mapping, int)
                                    and port_mapping == new_port
                                ):
                                    port_exposed = True
                                    break
                        if port_exposed:
                            break
                    if not port_exposed:
                        raise HTTPException(
                            status_code=status.HTTP_400_BAD_REQUEST,
                            detail=f"Port {new_port} is not exposed in the compose template",
                        )
                except ValueError as e:
                    raise HTTPException(
                        status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)
                    )
    # Validate required variables for compose definitions
    definition_type = update_data.get("definition_type", tool_type.definition_type)
    if definition_type == "compose":
        if "required_variables" in update_data and "compose_template" in update_data:
-            template = update_data["compose_template"]
+            validate_required_variables(
-            for var in update_data["required_variables"]:
+                update_data["compose_template"], update_data["required_variables"]
                placeholder = f"{{{{{var}}}}}"
                if placeholder not in template:
                    raise HTTPException(
                        status_code=status.HTTP_400_BAD_REQUEST,
                        detail=f"Required variable '{var}' not found in compose template",
            )
        elif "required_variables" in update_data:
            template = tool_type.compose_template
            if template:
-                for var in update_data["required_variables"]:
+                validate_required_variables(template, update_data["required_variables"])
-                    placeholder = f"{{{{{var}}}}}"
+
-                    if placeholder not in template:
+    # When switching to manifest, clear legacy templates
-                        raise HTTPException(
+    if definition_type == "manifest":
-                            status_code=status.HTTP_400_BAD_REQUEST,
+        if "manifest_id" in update_data:
-                            detail=f"Required variable '{var}' not found in compose template",
+            tool_type.manifest_id = update_data["manifest_id"]
-                        )
+        tool_type.compose_template = None
        tool_type.dockerfile_template = None
    for field, value in update_data.items():
        setattr(tool_type, field, value)
@@ -253,6 +461,12 @@ async def update_tool_type(
    return tool_type
 class ToolTypeValidateRequest(BaseModel):
    definition_type: str
    compose_template: str | None = None
    dockerfile_template: str | None = None
@router.post(
    "/validate",
    summary="Validate tool type template",
@@ -260,7 +474,7 @@ async def update_tool_type(
 )
 async def validate_tool_type_template(
    data: ToolTypeValidateRequest,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Validate a tool type template syntax.
@@ -273,6 +487,7 @@ async def validate_tool_type_template(
    Returns:
        Validation result with success status and any errors.
    """
    await _get_user(session, user_id)
    errors = []
@@ -281,15 +496,9 @@ async def validate_tool_type_template(
            errors.append("Compose template is required")
        else:
            try:
-                parsed = yaml.safe_load(data.compose_template)
+                validate_compose_yaml(data.compose_template)
-                if not isinstance(parsed, dict):
+            except ValueError as e:
-                    errors.append("Compose template must be a YAML mapping")
+                errors.append(str(e))
                elif "services" not in parsed:
                    errors.append("Compose template must contain 'services' key")
                elif not parsed["services"]:
                    errors.append("Compose template must define at least one service")
            except yaml.YAMLError as e:
                errors.append(f"Invalid YAML: {e}")
    elif data.definition_type == "dockerfile":
        if not data.dockerfile_template:
@@ -297,8 +506,11 @@ async def validate_tool_type_template(
        elif not data.dockerfile_template.strip().startswith("FROM"):
            errors.append("Dockerfile must start with a FROM instruction")
    elif data.definition_type == "manifest":
        pass  # Manifest validation is handled separately
    else:
-        errors.append("definition_type must be 'compose' or 'dockerfile'")
+        errors.append("definition_type must be 'compose', 'dockerfile', or 'manifest'")
    return {
        "valid": len(errors) == 0,
@@ -313,7 +525,7 @@ async def validate_tool_type_template(
 )
 async def validate_tool_type(
    tool_type_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> dict:
    """Validate a tool type's template syntax.
@@ -326,6 +538,7 @@ async def validate_tool_type(
    Returns:
        Validation result with success status and any errors.
    """
    await _get_user(session, user_id)
    tool_type = await session.get(ToolType, tool_type_id)
    if tool_type is None:
        raise HTTPException(
@@ -339,15 +552,9 @@ async def validate_tool_type(
            errors.append("Compose template is empty")
        else:
            try:
-                parsed = yaml.safe_load(tool_type.compose_template)
+                validate_compose_yaml(tool_type.compose_template)
-                if not isinstance(parsed, dict):
+            except ValueError as e:
-                    errors.append("Compose template must be a YAML mapping")
+                errors.append(str(e))
                elif "services" not in parsed:
                    errors.append("Compose template must contain 'services' key")
                elif not parsed["services"]:
                    errors.append("Compose template must define at least one service")
            except yaml.YAMLError as e:
                errors.append(f"Invalid YAML: {e}")
    elif tool_type.definition_type == "dockerfile":
        if not tool_type.dockerfile_template:
@@ -355,6 +562,10 @@ async def validate_tool_type(
        elif not tool_type.dockerfile_template.strip().startswith("FROM"):
            errors.append("Dockerfile must start with a FROM instruction")
    elif tool_type.definition_type == "manifest":
        if not tool_type.manifest_id:
            errors.append("Manifest reference is missing")
    return {
        "valid": len(errors) == 0,
        "errors": errors,
@@ -369,7 +580,7 @@ async def validate_tool_type(
 )
 async def delete_tool_type(
    tool_type_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> None:
    """Delete a tool type.
@@ -382,6 +593,7 @@ async def delete_tool_type(
    Returns:
        None with 204 status code.
    """
    user = await _get_user(session, user_id)
    await _require_admin(user)
    tool_type = await session.get(ToolType, tool_type_id)
@@ -390,11 +602,7 @@ async def delete_tool_type(
            status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
        )
-    if tool_type.is_builtin:
+    # Built-in tool types can now be deleted
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="cannot delete built-in tool types",
        )
    await session.delete(tool_type)
    await session.commit()
@@ -1,20 +1,22 @@
 import logging
 import uuid
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
-from src.auth.dependencies import get_current_user, get_db_session
+from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
 from src.models.user import User
 from src.models.user_config import UserConfig
-from src.schemas.user_config import UserConfigResponse, UserConfigUpdate
+
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/users/me", tags=["user-config"])
-
+async def _get_or_create_config(
-async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> UserConfig:
+    session: AsyncSession, user_id: uuid.UUID
 ) -> UserConfig:
    """Get or create user config record.
    Args:
@@ -24,16 +26,40 @@ async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> Us
    Returns:
        The user's config, creating a new one if it doesn't exist.
    """
-    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user.id))
+    result = await session.execute(
        select(UserConfig).where(UserConfig.user_id == user_id)
    )
    config = result.scalar_one_or_none()
    if config is None:
-        config = UserConfig(user_id=user.id, config={})
+        config = UserConfig(user_id=user_id, config={})
        session.add(config)
        await session.commit()
        await session.refresh(config)
    return config
 class UserConfigResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    default_editor: str | None = None
    theme: str = "system"
    git_user_name: str | None = None
    git_user_email: str | None = None
    last_session_id: str | None = None
    notification_mute_categories: list[str] | None = None
    notification_toast_level: str | None = None
 class UserConfigUpdate(BaseModel):
    default_editor: str | None = None
    theme: str | None = None
    git_user_name: str | None = None
    git_user_email: str | None = None
    last_session_id: str | None = None
    notification_mute_categories: list[str] | None = None
    notification_toast_level: str | None = None
@router.get(
    "/config",
    response_model=UserConfigResponse,
@@ -41,7 +67,7 @@ async def _get_or_create_config(session: AsyncSession, user_id: uuid.UUID) -> Us
    description="Get the current user's configuration settings.",
 )
 async def get_user_config(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> UserConfigResponse:
    """Get the current user's configuration.
@@ -53,7 +79,8 @@ async def get_user_config(
    Returns:
        The user's configuration settings.
    """
-    config = await _get_or_create_config(session, user.id)
+    _user = await _get_user(session, user_id)
    config = await _get_or_create_config(session, user_id)
    return UserConfigResponse.model_validate(config.config)
@@ -65,7 +92,7 @@ async def get_user_config(
 )
 async def update_user_config(
    data: UserConfigUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> UserConfigResponse:
    """Update the current user's configuration.
@@ -78,15 +105,16 @@ async def update_user_config(
    Returns:
        The updated user configuration.
    """
-    config = await _get_or_create_config(session, user.id)
+    _user = await _get_user(session, user_id)
    config = await _get_or_create_config(session, user_id)
    # Merge updates
    update_data = data.model_dump(exclude_unset=True)
-    logger.info("Updating user config for user %s: %s", user.id, update_data)
+    logger.debug("Updating user config for user %s: %s", user_id, update_data)
    # SQLAlchemy JSON doesn't track dict mutations, so we replace the whole dict
    config.config = {**config.config, **update_data}
    await session.commit()
    await session.refresh(config)
-    logger.info("Updated config: %s", config.config)
+    logger.debug("Updated config: %s", config.config)
    return UserConfigResponse.model_validate(config.config)
@@ -2,14 +2,11 @@ import uuid
 from pathlib import Path
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, status
-from sqlalchemy import select
+from pydantic import BaseModel, ConfigDict
 from sqlalchemy.ext.asyncio import AsyncSession
-from src.auth.dependencies import get_current_user, get_db_session
+from src.auth.dependencies import _get_user, get_current_user_id, get_db_session
 from src.models.tool_instance import ToolInstance
 from src.models.user import User
 from src.schemas.tool_instance import SessionItemResponse, SessionListResponse
 from src.schemas.user import UserProfileResponse, UserProfileUpdate
 router = APIRouter(prefix="/users", tags=["users"])
@@ -19,6 +16,20 @@ ALLOWED_CONTENT_TYPES = {"image/png", "image/jpeg", "image/jpg"}
 MAX_AVATAR_SIZE = 2 * 1024 * 1024  # 2MB
 class UserProfileResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    email: str
    name: str
    avatar_url: str | None
 class UserProfileUpdate(BaseModel):
    name: str | None = None
    email: str | None = None
@router.get(
    "/me",
    response_model=UserProfileResponse,
@@ -26,7 +37,7 @@ MAX_AVATAR_SIZE = 2 * 1024 * 1024  # 2MB
    description="Retrieve the profile of the currently authenticated user.",
 )
 async def get_profile(
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> User:
    """Get the current user's profile.
@@ -38,7 +49,7 @@ async def get_profile(
    Returns:
        The user's profile information.
    """
-    return user
+    return await _get_user(session, user_id)
@router.put(
@@ -49,7 +60,7 @@ async def get_profile(
 )
 async def update_profile(
    data: UserProfileUpdate,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> User:
    """Update the current user's profile.
@@ -62,19 +73,16 @@ async def update_profile(
    Returns:
        The updated user profile.
    """
    user = await _get_user(session, user_id)
    if data.name is not None:
        if len(data.name.strip()) == 0:
-            raise HTTPException(
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="name cannot be empty")
                status_code=status.HTTP_400_BAD_REQUEST, detail="name cannot be empty"
            )
        user.name = data.name.strip()
    if data.email is not None:
        if "@" not in data.email:
-            raise HTTPException(
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="invalid email")
                status_code=status.HTTP_400_BAD_REQUEST, detail="invalid email"
            )
        user.email = data.email.strip()
    await session.commit()
@@ -90,7 +98,7 @@ async def update_profile(
 )
 async def upload_avatar(
    file: UploadFile,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID = Depends(get_current_user_id),
    session: AsyncSession = Depends(get_db_session),
 ) -> User:
    """Upload a profile avatar image.
@@ -103,6 +111,7 @@ async def upload_avatar(
    Returns:
        The updated user profile with new avatar URL.
    """
    user = await _get_user(session, user_id)
    if file.content_type not in ALLOWED_CONTENT_TYPES:
        raise HTTPException(
@@ -137,41 +146,3 @@ async def upload_avatar(
    await session.commit()
    await session.refresh(user)
    return user
@router.get(
    "/me/sessions",
    response_model=SessionListResponse,
    summary="Get current user sessions",
    description="Retrieve all tool instances (sessions) for the authenticated user.",
 )
 async def get_user_sessions(
    user: User = Depends(get_current_user),
    session: AsyncSession = Depends(get_db_session),
 ) -> SessionListResponse:
    """Return all tool instances for the current user with related names."""
    result = await session.execute(
        select(ToolInstance)
        .where(ToolInstance.owner_id == user.id)
        .order_by(ToolInstance.created_at.desc())
    )
    instances = result.scalars().all()
    sessions = [
        SessionItemResponse(
            id=str(inst.id),
            display_name=inst.display_name,
            tool_type_name=inst.tool_type.display_name if inst.tool_type else "Unknown",
            tool_icon=None,
            tool_type_interfaces=inst.tool_type.interfaces if inst.tool_type else [],
            repository_name=inst.repository.name if inst.repository else "Unknown",
            repository_id=str(inst.repository_id),
            project_name=inst.project.name if inst.project else "Unknown",
            project_id=str(inst.project_id),
            status=inst.status,
            url=inst.url,
        )
        for inst in instances
    ]
    return SessionListResponse(sessions=sessions)
@@ -50,17 +50,25 @@ async def get_current_user(
    return user
-async def get_owned_project(
+async def _get_user(session: AsyncSession, user_id: uuid.UUID) -> User:
    """Fetch a user by ID or raise 401 if not found."""
    user = await session.get(User, user_id)
    if user is None:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
    return user
 async def _get_owned_project(
    project_id: uuid.UUID,
-    user: User = Depends(get_current_user),
+    user_id: uuid.UUID,
-    db_session: AsyncSession = Depends(get_db_session),
+    session: AsyncSession,
-) -> Project:
+) -> "Project":
    """Fetch a project and verify ownership.
    Args:
-        project_id: UUID of the project (injected from path parameter).
+        project_id: UUID of the project.
-        user: The currently authenticated user.
+        user_id: ID of the authenticated user.
-        db_session: Database session.
+        session: Database session.
    Returns:
        The project if found and owned by the user.
@@ -68,9 +76,11 @@ async def get_owned_project(
    Raises:
        HTTPException: 404 if project not found, 403 if user is not the owner.
    """
-    project = await db_session.get(Project, project_id)
+    from src.models.project import Project
    project = await session.get(Project, project_id)
    if project is None:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="project not found")
-    if project.owner_id != user.id:
+    if project.owner_id != user_id:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="not project owner")
    return project
@@ -6,8 +6,10 @@ from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
 from src.api.auth import router as auth_router
 from src.api.dashboard import router as dashboard_router
 from src.api.events import router as events_router
 from src.api.git_repositories import router as git_repositories_router
 from src.api.health import router as health_router
 from src.api.projects import router as projects_router
@@ -15,18 +17,29 @@ from src.api.ssh_keys import router as ssh_keys_router
 from src.api.terminal import router as terminal_router
 from src.api.instance_proxy import router as instance_proxy_router
 from src.api.config_profiles import router as config_profiles_router
 from src.api.tool_definitions import router as tool_definitions_router
 from src.api.tool_instances import router as tool_instances_router
 from src.api.tool_instances import sessions_router
 from src.api.tool_types import router as tool_types_router
 from src.api.notifications import router as notifications_router
 from src.api.user_config import router as user_config_router
 from src.api.users import router as users_router
 from src.api.workspace_files import router as workspace_files_router
 from src.api.workspace_git import router as workspace_git_router
 from src.api.workspace_instances import router as workspace_instances_router
 from src.api.workspaces import all_workspaces_router, router as workspaces_router
 from src.config import Settings
 from src.models.notification import Notification  # noqa: F401 – Alembic model discovery
 from src.models.terminal_session import TerminalSessionModel  # noqa: F401 – Alembic model discovery
 from src.database import init_database
 from src.logging_config import (
    ExceptionLoggingMiddleware,
    RequestLoggingMiddleware,
    configure_logging,
 )
-from src.seeds.builtin_tool_types import seed_builtin_tool_types
+from src.services.correlation import CorrelationIdMiddleware
 from src.services.event_bus import InstanceEventBus
 from src.services.health_monitor import HealthMonitor
 # Configure logging early
 log_level = os.getenv("LOG_LEVEL", "INFO").upper()
@@ -51,6 +64,7 @@ app.add_middleware(
    allow_headers=["*"],
 )
 app.add_middleware(CorrelationIdMiddleware)
 app.add_middleware(RequestLoggingMiddleware)
 app.add_middleware(ExceptionLoggingMiddleware)
@@ -100,6 +114,11 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
    )
 # Global services
 _event_bus = InstanceEventBus()
 _health_monitor = HealthMonitor(_event_bus)
@app.on_event("startup")
 async def on_startup():
    logger.info("Starting up Headquarter API...")
@@ -112,11 +131,21 @@ async def on_startup():
        sys.exit(1)
-    # Seed built-in data
+    # Start background health monitor
-    await seed_builtin_tool_types()
+    _health_monitor.start()
    logger.info("Health monitor started")
    logger.info("Startup complete.")
@app.on_event("shutdown")
 async def on_shutdown():
    logger.info("Shutting down Headquarter API...")
    _health_monitor.stop()
    logger.info("Health monitor stopped")
    logger.info("Shutdown complete.")
 app.include_router(health_router)
 app.include_router(auth_router)
 app.include_router(dashboard_router)
@@ -126,8 +155,17 @@ app.include_router(ssh_keys_router)
 app.include_router(git_repositories_router)
 app.include_router(user_config_router)
 app.include_router(tool_types_router)
 app.include_router(tool_definitions_router)
 app.include_router(config_profiles_router)
 app.include_router(tool_instances_router)
 app.include_router(sessions_router)
 app.include_router(instance_proxy_router)
 app.include_router(terminal_router)
 app.include_router(events_router)
 app.include_router(notifications_router)
 app.include_router(all_workspaces_router)
 app.include_router(workspaces_router)
 app.include_router(workspace_files_router)
 app.include_router(workspace_git_router)
 app.include_router(workspace_instances_router)
 app.mount("/uploads", StaticFiles(directory="uploads"), name="uploads")
@@ -1,25 +1,34 @@
 from src.models.base import Base
-from src.models.config_include import ConfigInclude
+from src.models.config_profile import ConfigProfile, ConfigProfileInclude
 from src.models.config_mount import ConfigMount
 from src.models.config_profile import ConfigProfile
 from src.models.git_repository import GitRepository
 from src.models.health_check import HealthCheck
 from src.models.instance_event import InstanceEvent
 from src.models.notification import Notification
 from src.models.project import Project
 from src.models.ssh_key import SSHKey
 from src.models.terminal_session import TerminalSessionModel
 from src.models.tool_definition_manifest import ToolDefinitionManifest
 from src.models.tool_instance import ToolInstance
 from src.models.tool_type import ToolType
 from src.models.user import User
 from src.models.user_config import UserConfig
 from src.models.workspace import Workspace
 __all__ = [
    "Base",
    "ConfigInclude",
    "ConfigMount",
    "ConfigProfile",
    "ConfigProfileInclude",
    "GitRepository",
    "HealthCheck",
    "InstanceEvent",
    "Notification",
    "Project",
    "SSHKey",
    "TerminalSessionModel",
    "ToolDefinitionManifest",
    "ToolInstance",
    "ToolType",
    "User",
    "UserConfig",
    "Workspace",
 ]
@@ -1,36 +0,0 @@
 import uuid
 from typing import TYPE_CHECKING
 from sqlalchemy import ForeignKey, Integer, UniqueConstraint
 from sqlalchemy import Uuid as UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 if TYPE_CHECKING:
    from src.models.config_profile import ConfigProfile
 class ConfigInclude(UUIDPrimaryKeyMixin, TimestampMixin, Base):
    __tablename__ = "config_includes"
    __table_args__ = (
        UniqueConstraint("profile_id", "included_profile_id", name="uq_config_includes_pair"),
    )
    profile_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
    )
    included_profile_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
    )
    order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
    profile: Mapped["ConfigProfile"] = relationship(
        "ConfigProfile",
        foreign_keys=[profile_id],
        back_populates="includes",
    )
    included_profile: Mapped["ConfigProfile"] = relationship(
        "ConfigProfile",
        foreign_keys=[included_profile_id],
    )
@@ -1,31 +0,0 @@
 import uuid
 from typing import TYPE_CHECKING
 from sqlalchemy import ForeignKey, Integer, JSON, String
 from sqlalchemy import Uuid as UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 if TYPE_CHECKING:
    from src.models.config_profile import ConfigProfile
 class ConfigMount(UUIDPrimaryKeyMixin, TimestampMixin, Base):
    __tablename__ = "config_mounts"
    profile_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
    )
    target_path: Mapped[str] = mapped_column(String(1024), nullable=False)
    mode: Mapped[str] = mapped_column(String(10), nullable=False, default="rw")
    files: Mapped[dict[str, str] | None] = mapped_column(
        JSON, default=dict, nullable=True
    )
    order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
    profile: Mapped["ConfigProfile"] = relationship(
        "ConfigProfile",
        foreign_keys=[profile_id],
        back_populates="mounts",
    )
@@ -1,15 +1,13 @@
 import uuid
 from typing import TYPE_CHECKING
-from sqlalchemy import ForeignKey, Integer, JSON, String, Text, UniqueConstraint
+from sqlalchemy import ForeignKey, JSON, Integer, String, Text, Boolean
 from sqlalchemy import Uuid as UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 if TYPE_CHECKING:
    from src.models.config_include import ConfigInclude
    from src.models.config_mount import ConfigMount
    from src.models.project import Project
    from src.models.tool_type import ToolType
    from src.models.user import User
@@ -17,43 +15,63 @@ if TYPE_CHECKING:
 class ConfigProfile(UUIDPrimaryKeyMixin, TimestampMixin, Base):
    __tablename__ = "config_profiles"
    __table_args__ = (
        UniqueConstraint("user_id", "name", name="uq_config_profiles_user_name"),
    )
    user_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("users.id", ondelete="CASCADE"), nullable=False
    )
    name: Mapped[str] = mapped_column(String(255), nullable=False)
    description: Mapped[str | None] = mapped_column(Text, nullable=True)
    project_id: Mapped[uuid.UUID | None] = mapped_column(
        UUID(), ForeignKey("projects.id", ondelete="CASCADE"), nullable=True
    )
    tool_type_id: Mapped[uuid.UUID | None] = mapped_column(
        UUID(), ForeignKey("tool_types.id", ondelete="CASCADE"), nullable=True
    )
-    name: Mapped[str] = mapped_column(String(255), nullable=False)
+    env_vars: Mapped[dict] = mapped_column(
-    description: Mapped[str | None] = mapped_column(Text, nullable=True)
+        JSON, default=dict, nullable=False
-    environment_variables: Mapped[dict[str, str] | None] = mapped_column(
+    )  # {"VAR_NAME": "value", ...}
-        JSON, default=dict, nullable=True
+    runtime_hints: Mapped[dict] = mapped_column(
-    )
+        JSON, default=dict, nullable=False
-    start_command: Mapped[str | None] = mapped_column(Text, nullable=True)
+    )  # {"start_command": "...", "working_dir": "...", ...}
-    working_directory: Mapped[str | None] = mapped_column(Text, nullable=True)
+    mounts: Mapped[list] = mapped_column(
-    port: Mapped[int | None] = mapped_column(Integer, nullable=True)
+        JSON, default=list, nullable=False
-    is_default: Mapped[bool] = mapped_column(default=False, nullable=False)
+    )  # [{"target": "/path", "mode": "rw", "files": {"rel/path": "content"}}, ...]
    files: Mapped[dict] = mapped_column(
        JSON, default=dict, nullable=False
    )  # {"rel/path": "content", ...}
    git_mounts: Mapped[list] = mapped_column(
        JSON, default=list, nullable=False
    )  # [{"remote_url": "https://github.com/user/repo.git", "source_path": ".", "target_path": "/path", "branch": "main"}, ...]
    is_default: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
    user: Mapped["User"] = relationship()
    project: Mapped["Project | None"] = relationship()
    tool_type: Mapped["ToolType | None"] = relationship()
-    includes: Mapped[list["ConfigInclude"]] = relationship(
+    includes: Mapped[list["ConfigProfileInclude"]] = relationship(
-        "ConfigInclude",
+        "ConfigProfileInclude",
-        primaryjoin="ConfigProfile.id == ConfigInclude.profile_id",
+        foreign_keys="ConfigProfileInclude.profile_id",
-        back_populates="profile",
+        order_by="ConfigProfileInclude.order_index",
        cascade="all, delete-orphan",
        order_by="ConfigInclude.order_index",
    )
-    mounts: Mapped[list["ConfigMount"]] = relationship(
+
-        "ConfigMount",
+
-        primaryjoin="ConfigProfile.id == ConfigMount.profile_id",
+class ConfigProfileInclude(UUIDPrimaryKeyMixin, TimestampMixin, Base):
-        back_populates="profile",
+    __tablename__ = "config_profile_includes"
-        cascade="all, delete-orphan",
+
-        order_by="ConfigMount.order_index",
+    profile_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
    )
    included_profile_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("config_profiles.id", ondelete="CASCADE"), nullable=False
    )
    order_index: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
    profile: Mapped["ConfigProfile"] = relationship(
        "ConfigProfile",
        foreign_keys=[profile_id],
        back_populates="includes",
    )
    included_profile: Mapped["ConfigProfile"] = relationship(
        "ConfigProfile",
        foreign_keys=[included_profile_id],
    )
@@ -2,7 +2,7 @@ import uuid
 from datetime import datetime
 from typing import TYPE_CHECKING
-from sqlalchemy import DateTime, ForeignKey, Integer, String
+from sqlalchemy import DateTime, ForeignKey, Integer, JSON, String
 from sqlalchemy import Uuid as UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
@@ -14,6 +14,7 @@ if TYPE_CHECKING:
    from src.models.project import Project
    from src.models.tool_type import ToolType
    from src.models.user import User
    from src.models.workspace import Workspace
 class ToolInstance(UUIDPrimaryKeyMixin, TimestampMixin, Base):
@@ -33,42 +34,40 @@ class ToolInstance(UUIDPrimaryKeyMixin, TimestampMixin, Base):
    owner_id: Mapped[uuid.UUID] = mapped_column(
        UUID(), ForeignKey("users.id"), nullable=False
    )
-    status: Mapped[str] = mapped_column(
+    status: Mapped[str] = mapped_column(String(50), nullable=False, default="pending")
-        String(50), nullable=False, default="pending"
+    container_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
-    )
+    container_name: Mapped[str | None] = mapped_column(String(255), nullable=True)
-    container_id: Mapped[str | None] = mapped_column(
+    compose_path: Mapped[str | None] = mapped_column(String(1024), nullable=True)
-        String(255), nullable=True
+    url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
-    )
+    public_url: Mapped[str | None] = mapped_column(String(1024), nullable=True)
-    container_name: Mapped[str | None] = mapped_column(
+    tunnel_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
-        String(255), nullable=True
+    port: Mapped[int | None] = mapped_column(Integer, nullable=True)
    )
    compose_path: Mapped[str | None] = mapped_column(
        String(1024), nullable=True
    )
    url: Mapped[str | None] = mapped_column(
        String(1024), nullable=True
    )
    public_url: Mapped[str | None] = mapped_column(
        String(1024), nullable=True
    )
    tunnel_id: Mapped[str | None] = mapped_column(
        String(255), nullable=True
    )
    port: Mapped[int | None] = mapped_column(
        Integer, nullable=True
    )
    last_started_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
    last_stopped_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
-    selected_profile_id: Mapped[uuid.UUID | None] = mapped_column(
+    manifest_compiled_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
    image_tag: Mapped[str | None] = mapped_column(String(256), nullable=True)
    probe_result: Mapped[dict | None] = mapped_column(JSON, nullable=True)
    clone_mode: Mapped[str] = mapped_column(String(20), nullable=False, default="mount")
    branch: Mapped[str | None] = mapped_column(
        String(255), nullable=True, default="main"
    )
    selected_config_profile_id: Mapped[uuid.UUID | None] = mapped_column(
        UUID(), ForeignKey("config_profiles.id", ondelete="SET NULL"), nullable=True
    )
    ssh_key_ids: Mapped[list[str] | None] = mapped_column(JSON, nullable=True)
    workspace_id: Mapped[uuid.UUID | None] = mapped_column(
        UUID(), ForeignKey("workspaces.id", ondelete="SET NULL"), nullable=True
    )
    tool_type: Mapped["ToolType"] = relationship()
    workspace: Mapped["Workspace | None"] = relationship()
    repository: Mapped["GitRepository"] = relationship()
    project: Mapped["Project"] = relationship()
    owner: Mapped["User"] = relationship()
-    selected_profile: Mapped["ConfigProfile | None"] = relationship()
+    selected_config_profile: Mapped["ConfigProfile | None"] = relationship()
@@ -1,13 +1,15 @@
 import uuid
 from typing import TYPE_CHECKING
-from sqlalchemy import Boolean, ForeignKey, JSON, String, Text, Uuid as UUID
+from sqlalchemy import Boolean, ForeignKey, JSON, String, Text
 from sqlalchemy import Uuid as UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from src.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 if TYPE_CHECKING:
 from src.models.tool_definition_manifest import ToolDefinitionManifest
 if TYPE_CHECKING:
    from src.models.user import User
@@ -51,21 +53,3 @@ class ToolType(UUIDPrimaryKeyMixin, TimestampMixin, Base):
        foreign_keys=[manifest_id],
    )
    created_by: Mapped["User | None"] = relationship()
    @property
    def interfaces(self) -> list[str]:
        """Backward-compatible API view for the single interface type."""
        return [self.interface_type]
    @interfaces.setter
    def interfaces(self, value: list[str] | str) -> None:
        """Accept legacy interface lists and store the first interface type."""
        if isinstance(value, str):
            self.interface_type = value
            return
        self.interface_type = value[0] if value else "web"
    @property
    def is_builtin(self) -> bool:
        """Built-in tools are seeded system tools without a creating user."""
        return self.created_by_id is None
@@ -18,23 +18,3 @@ class UserConfig(UUIDPrimaryKeyMixin, TimestampMixin, Base):
    config: Mapped[dict[str, object]] = mapped_column(JSON, default=dict, nullable=False)
    user: Mapped["User"] = relationship(back_populates="user_config")
    @property
    def default_profile_id(self) -> uuid.UUID | None:
        profile_id = self.config.get("default_profile_id")
        return uuid.UUID(profile_id) if profile_id else None
    @default_profile_id.setter
    def default_profile_id(self, value: uuid.UUID | None) -> None:
        if value is not None:
            self.config["default_profile_id"] = str(value)
        elif "default_profile_id" in self.config:
            del self.config["default_profile_id"]
    @property
    def default_profiles(self) -> dict[str, str]:
        return self.config.get("default_profiles", {})
    @default_profiles.setter
    def default_profiles(self, value: dict[str, str]) -> None:
        self.config["default_profiles"] = value
@@ -1 +0,0 @@
 """Pydantic request/response schemas."""
@@ -1,131 +0,0 @@
 """Config profile request/response schemas."""
 from typing import Any
 from pydantic import BaseModel, Field, field_validator
 MAX_MOUNT_PATH_LENGTH = 1024
 class ConfigProfileCreate(BaseModel):
    name: str = Field(description="Profile name (unique per user)")
    description: str | None = Field(default=None, description="Optional description")
    @field_validator("name")
    @classmethod
    def validate_name(cls, v: str) -> str:
        v = v.strip()
        if not v:
            raise ValueError("Profile name cannot be empty")
        if len(v) > 255:
            raise ValueError("Profile name must be 255 characters or less")
        return v
 class ConfigProfileUpdate(BaseModel):
    name: str | None = Field(default=None, description="Profile name")
    description: str | None = Field(default=None, description="Optional description")
    @field_validator("name")
    @classmethod
    def validate_name(cls, v: str | None) -> str | None:
        if v is None:
            return v
        v = v.strip()
        if not v:
            raise ValueError("Profile name cannot be empty")
        if len(v) > 255:
            raise ValueError("Profile name must be 255 characters or less")
        return v
 class ConfigProfileResponse(BaseModel):
    id: str
    user_id: str
    name: str
    description: str | None
    created_at: str
    updated_at: str
 class ConfigProfileDetailResponse(ConfigProfileResponse):
    includes: list[dict[str, Any]]
    mounts: list[dict[str, Any]]
 class ConfigIncludeCreate(BaseModel):
    included_profile_id: str = Field(description="UUID of the profile to include")
    order_index: int = Field(default=0, description="Order index for include resolution")
 class ConfigIncludeUpdate(BaseModel):
    order_index: int = Field(description="Order index for include resolution")
 class ConfigIncludeResponse(BaseModel):
    id: str
    profile_id: str
    included_profile_id: str
    included_profile_name: str | None
    order_index: int
    created_at: str
    updated_at: str
 class ConfigMountCreate(BaseModel):
    target_path: str = Field(description="Absolute target path in container")
    mode: str = Field(default="rw", description="Mount mode (rw or ro)")
    files: dict[str, str] | None = Field(
        default=None, description="Files as {path: content}"
    )
    order_index: int = Field(default=0, description="Order index for mount resolution")
    @field_validator("target_path")
    @classmethod
    def validate_target_path(cls, v: str) -> str:
        if not v.startswith("/"):
            raise ValueError("Target path must be absolute (start with /)")
        if ".." in v:
            raise ValueError("Target path cannot contain parent directory references (..)")
        if len(v) > MAX_MOUNT_PATH_LENGTH:
            raise ValueError(f"Target path must be {MAX_MOUNT_PATH_LENGTH} characters or less")
        return v
 class ConfigMountUpdate(BaseModel):
    target_path: str | None = Field(default=None, description="Absolute target path in container")
    mode: str | None = Field(default=None, description="Mount mode (rw or ro)")
    files: dict[str, str] | None = Field(
        default=None, description="Files as {path: content}"
    )
    order_index: int | None = Field(default=None, description="Order index for mount resolution")
    @field_validator("target_path")
    @classmethod
    def validate_target_path(cls, v: str | None) -> str | None:
        if v is None:
            return v
        if not v.startswith("/"):
            raise ValueError("Target path must be absolute (start with /)")
        if ".." in v:
            raise ValueError("Target path cannot contain parent directory references (..)")
        if len(v) > MAX_MOUNT_PATH_LENGTH:
            raise ValueError(f"Target path must be {MAX_MOUNT_PATH_LENGTH} characters or less")
        return v
 class ConfigMountResponse(BaseModel):
    id: str
    profile_id: str
    target_path: str
    mode: str
    files: dict[str, str] | None
    order_index: int
    created_at: str
    updated_at: str
 class DefaultProfilesUpdate(BaseModel):
    default_profiles: dict[str, str] = Field(
        description="Mapping of tool_type_id to profile_id"
    )
@@ -1,129 +0,0 @@
 """Git repository request/response schemas."""
 import uuid
 from datetime import datetime
 from pydantic import BaseModel, ConfigDict
 class GitRepositoryCreate(BaseModel):
    name: str
    remote_url: str | None = None
    force_original_url: bool = False
 class URLParseRequest(BaseModel):
    url: str
 class URLParseResponse(BaseModel):
    original_url: str
    base_url: str | None
    is_valid_clone_url: bool
    needs_parsing: bool
    host: str | None
    message: str
    error_code: str | None
 class GitRepositoryResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    name: str
    path: str
    project_id: uuid.UUID
    owner_id: uuid.UUID
    is_mirror: bool
    remote_url: str | None
    last_push: datetime | None
    created_at: datetime
    updated_at: datetime
 class FileListResponse(BaseModel):
    path: str
    branch: str
    entries: list[dict]
 class FileContentResponse(BaseModel):
    path: str
    branch: str
    content: str
    size: int
    encoding: str
    language: str | None
    is_binary: bool
    last_commit: dict | None
 class BranchesResponse(BaseModel):
    branches: list[dict]
    default_branch: str
 class FileUpdateRequest(BaseModel):
    path: str
    branch: str
    content: str
    commit_message: str
 class FileUpdateResponse(BaseModel):
    commit_hash: str
    message: str
    branch: str
 class StatusResponse(BaseModel):
    branch: str
    modified: list[str]
    added: list[str]
    deleted: list[str]
    untracked: list[str]
    renamed: list[str]
    ahead: int
    behind: int
 class BranchCreateRequest(BaseModel):
    name: str
    base_branch: str = "HEAD"
 class CheckoutRequest(BaseModel):
    branch: str
 class CommitRequest(BaseModel):
    message: str
    files: list[str] | None = None
 class CommitResponse(BaseModel):
    commit_hash: str
    message: str
 class FetchResponse(BaseModel):
    message: str
 class PullResponse(BaseModel):
    message: str
 class PushResponse(BaseModel):
    message: str
 class MergeRequest(BaseModel):
    source_branch: str
    target_branch: str | None = None
    message: str | None = None
 class MergeResponse(BaseModel):
    commit_hash: str
    message: str
@@ -1,50 +0,0 @@
 """Health check response schemas."""
 from pydantic import BaseModel, Field
 class DatabaseHealth(BaseModel):
    """Database health check result."""
    status: str = Field(description="Database health status", examples=["healthy"])
    response_time_ms: float = Field(
        description="Query response time in milliseconds", examples=[5.2]
    )
 class DiskHealth(BaseModel):
    """Disk space health check result."""
    status: str = Field(description="Disk health status", examples=["healthy"])
    free_gb: float = Field(description="Free disk space in GB", examples=[45.2])
    total_gb: float = Field(description="Total disk space in GB", examples=[100.0])
 class HealthChecks(BaseModel):
    """Individual health checks."""
    database: DatabaseHealth | None = None
    disk: DiskHealth | None = None
 class HealthResponse(BaseModel):
    """Overall health check response."""
    status: str = Field(description="Overall health status", examples=["healthy"])
    timestamp: str = Field(
        description="ISO 8601 timestamp", examples=["2026-05-19T12:00:00Z"]
    )
    version: str = Field(description="API version", examples=["0.1.0"])
    checks: HealthChecks = Field(description="Individual health checks")
    uptime_seconds: float = Field(
        description="Server uptime in seconds", examples=[3600.0]
    )
 class DatabaseHealthResponse(BaseModel):
    """Database-specific health check response."""
    status: str = Field(description="Database health status", examples=["healthy"])
    response_time_ms: float = Field(
        description="Query response time in milliseconds", examples=[5.2]
    )
@@ -1,25 +0,0 @@
 """Project request/response schemas."""
 from pydantic import BaseModel
 class ProjectCreate(BaseModel):
    name: str
    description: str | None = None
 class ProjectUpdate(BaseModel):
    name: str | None = None
    description: str | None = None
 class ProjectResponse(BaseModel):
    id: str
    name: str
    description: str | None
    created_at: str
    updated_at: str
 class SetDefaultSSHKeyRequest(BaseModel):
    ssh_key_id: str
@@ -1,16 +0,0 @@
 """SSH key request/response schemas."""
 from pydantic import BaseModel
 class SSHKeyCreate(BaseModel):
    name: str
    public_key: str
 class SSHKeyResponse(BaseModel):
    id: str
    name: str
    public_key: str
    fingerprint: str
    created_at: str
@@ -1,41 +0,0 @@
 """Tool instance request/response schemas."""
 from pydantic import BaseModel, Field
 class CreateInstanceRequest(BaseModel):
    """Request body for creating a tool instance."""
    model_config = {"extra": "ignore"}
    tool_type_id: str = Field(description="UUID of the tool type to instantiate")
    display_name: str | None = Field(
        default=None, description="Optional display name for the instance"
    )
    config_profile_id: str | None = Field(
        default=None, description="Optional config profile ID to apply to the instance"
    )
 class SessionItemResponse(BaseModel):
    """Lightweight session summary for sidebar and dashboard."""
    model_config = {"extra": "ignore"}
    id: str = Field(description="Session (tool instance) ID")
    display_name: str = Field(description="Display name of the session")
    tool_type_name: str = Field(description="Name of the tool type")
    tool_icon: str | None = Field(default=None, description="Icon URL for the tool type")
    tool_type_interfaces: list[str] = Field(default_factory=list, description="Supported interfaces")
    repository_name: str = Field(description="Name of the repository")
    repository_id: str = Field(description="Repository ID")
    project_name: str = Field(description="Name of the project")
    project_id: str = Field(description="Project ID")
    status: str = Field(description="Current status")
    url: str | None = Field(default=None, description="Access URL")
 class SessionListResponse(BaseModel):
    """Response wrapping a list of session summaries."""
    sessions: list[SessionItemResponse]
@@ -1,204 +0,0 @@
 """Tool type request/response schemas."""
 import uuid
 from datetime import datetime
 import yaml
 from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 class ToolTypeCreate(BaseModel):
    name: str
    display_name: str
    description: str | None = None
    default_port: int
    definition_type: str = "compose"
    compose_template: str | None = None
    dockerfile_template: str | None = None
    build_context: dict | None = None
    readiness_probe: dict | None = None
    required_variables: list[str] = []
    category: str = "other"
    interfaces: list[str] = ["web"]
    @field_validator("definition_type")
    @classmethod
    def validate_definition_type(cls, v: str) -> str:
        if v not in ("compose", "dockerfile"):
            raise ValueError("definition_type must be 'compose' or 'dockerfile'")
        return v
    @field_validator("compose_template")
    @classmethod
    def validate_compose_template(cls, v: str | None, info) -> str | None:
        data = info.data
        if data.get("definition_type") != "compose":
            return v
        if v is None:
            raise ValueError("compose_template is required when definition_type is 'compose'")
        try:
            parsed = yaml.safe_load(v)
        except yaml.YAMLError as e:
            raise ValueError(f"Invalid YAML: {e}")
        if not isinstance(parsed, dict):
            raise ValueError("Compose template must be a YAML mapping")
        if "services" not in parsed:
            raise ValueError("Compose template must contain 'services' key")
        if not parsed["services"]:
            raise ValueError("Compose template must define at least one service")
        return v
    @field_validator("dockerfile_template")
    @classmethod
    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
        data = info.data
        if data.get("definition_type") != "dockerfile":
            return v
        if v is None:
            raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
        if not v.strip().startswith("FROM"):
            raise ValueError("Dockerfile must start with a FROM instruction")
        return v
    @field_validator("default_port")
    @classmethod
    def validate_default_port(cls, v: int, info) -> int:
        if v <= 0 or v > 65535:
            raise ValueError("Port must be between 1 and 65535")
        data = info.data
        if data.get("definition_type") != "compose":
            return v
        template = data.get("compose_template")
        if not template:
            return v
        try:
            parsed = yaml.safe_load(template)
        except yaml.YAMLError:
            return v
        port_str = str(v)
        port_exposed = False
        if isinstance(parsed, dict) and "services" in parsed:
            for service_config in parsed["services"].values():
                if isinstance(service_config, dict) and "ports" in service_config:
                    for port_mapping in service_config["ports"]:
                        if isinstance(port_mapping, str) and port_str in port_mapping:
                            port_exposed = True
                            break
                        elif isinstance(port_mapping, int) and port_mapping == v:
                            port_exposed = True
                            break
                if port_exposed:
                    break
        if not port_exposed:
            raise ValueError(f"Port {v} is not exposed in the compose template. Add it to the 'ports' section.")
        return v
    @field_validator("required_variables")
    @classmethod
    def validate_required_variables(cls, v: list[str], info) -> list[str]:
        if not v:
            return v
        data = info.data
        if data.get("definition_type") != "compose":
            return v
        template = data.get("compose_template")
        if not template:
            return v
        for var in v:
            placeholder = f"{{{{{var}}}}}"
            if placeholder not in template:
                raise ValueError(f"Required variable '{var}' not found in compose template")
        return v
    @model_validator(mode="after")
    def validate_templates(self) -> "ToolTypeCreate":
        if self.definition_type == "dockerfile" and self.dockerfile_template is None:
            raise ValueError("dockerfile_template is required when definition_type is 'dockerfile'")
        if self.definition_type == "compose" and self.compose_template is None:
            raise ValueError("compose_template is required when definition_type is 'compose'")
        return self
 class ToolTypeUpdate(BaseModel):
    display_name: str | None = None
    description: str | None = None
    default_port: int | None = None
    definition_type: str | None = None
    compose_template: str | None = None
    dockerfile_template: str | None = None
    build_context: dict | None = None
    readiness_probe: dict | None = None
    required_variables: list[str] | None = None
    category: str | None = None
    interfaces: list[str] | None = None
    @field_validator("definition_type")
    @classmethod
    def validate_definition_type(cls, v: str | None) -> str | None:
        if v is None:
            return v
        if v not in ("compose", "dockerfile"):
            raise ValueError("definition_type must be 'compose' or 'dockerfile'")
        return v
    @field_validator("compose_template")
    @classmethod
    def validate_compose_template(cls, v: str | None, info) -> str | None:
        if v is None:
            return v
        data = info.data
        definition_type = data.get("definition_type")
        if definition_type and definition_type != "compose":
            return v
        try:
            parsed = yaml.safe_load(v)
        except yaml.YAMLError as e:
            raise ValueError(f"Invalid YAML: {e}")
        if not isinstance(parsed, dict):
            raise ValueError("Compose template must be a YAML mapping")
        if "services" not in parsed:
            raise ValueError("Compose template must contain 'services' key")
        if not parsed["services"]:
            raise ValueError("Compose template must define at least one service")
        return v
    @field_validator("dockerfile_template")
    @classmethod
    def validate_dockerfile_template(cls, v: str | None, info) -> str | None:
        if v is None:
            return v
        data = info.data
        definition_type = data.get("definition_type")
        if definition_type and definition_type != "dockerfile":
            return v
        if not v.strip().startswith("FROM"):
            raise ValueError("Dockerfile must start with a FROM instruction")
        return v
 class ToolTypeResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    name: str
    display_name: str
    description: str | None
    category: str
    interfaces: list[str]
    default_port: int
    definition_type: str
    compose_template: str | None
    dockerfile_template: str | None
    build_context: dict | None
    readiness_probe: dict | None
    required_variables: list[str]
    is_builtin: bool
    created_by_id: uuid.UUID | None
    created_at: datetime
    updated_at: datetime
 class ToolTypeValidateRequest(BaseModel):
    definition_type: str
    compose_template: str | None = None
    dockerfile_template: str | None = None
@@ -1,19 +0,0 @@
 """User request/response schemas."""
 import uuid
 from pydantic import BaseModel, ConfigDict
 class UserProfileResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    id: uuid.UUID
    email: str
    name: str
    avatar_url: str | None
 class UserProfileUpdate(BaseModel):
    name: str | None = None
    email: str | None = None
@@ -1,21 +0,0 @@
 """User config request/response schemas."""
 from pydantic import BaseModel, ConfigDict
 class UserConfigResponse(BaseModel):
    model_config = ConfigDict(from_attributes=True)
    default_editor: str | None = None
    theme: str = "system"
    git_user_name: str | None = None
    git_user_email: str | None = None
    last_session_id: str | None = None
 class UserConfigUpdate(BaseModel):
    default_editor: str | None = None
    theme: str | None = None
    git_user_name: str | None = None
    git_user_email: str | None = None
    last_session_id: str | None = None
@@ -1,162 +0,0 @@
 import logging
 from sqlalchemy import select
 from src.database import SessionLocal
 from src.models.tool_type import ToolType
 logger = logging.getLogger(__name__)
 async def _table_exists(session, table_name: str) -> bool:
    """Check if a table exists in the database."""
    from sqlalchemy import text
    try:
        result = await session.execute(
            text(
                """
                SELECT EXISTS (
                    SELECT FROM information_schema.tables
                    WHERE table_schema = 'public'
                    AND table_name = :table_name
                )
            """
            ),
            {"table_name": table_name},
        )
        return result.scalar() or False
    except Exception:
        return False
 async def seed_builtin_tool_types():
    async with SessionLocal() as session:
        # Check if tool_types table exists before attempting to seed
        if not await _table_exists(session, "tool_types"):
            logger.warning(
                "tool_types table does not exist. Skipping seeding. "
                "Migrations may not have run yet."
            )
            return
        builtin_types = [
            {
                "name": "code-server",
                "display_name": "VS Code Server",
                "description": "VS Code running in the browser via code-server",
                "category": "editor",
                "interface_type": "web",
                "compose_template": """version: "3.8"
 services:
  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: {{TOOL_NAME}}
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - {{REPO_PATH}}:/config/workspace
    ports:
      - "8443:8443"
    restart: unless-stopped""",
                "default_port": 8443,
                "required_variables": ["REPO_PATH", "TOOL_NAME"],
            },
            {
                "name": "jupyter-notebook",
                "display_name": "Jupyter Notebook",
                "description": "Jupyter Lab for interactive development",
                "category": "notebook",
                "interface_type": "web",
                "default_port": 8888,
                "compose_template": """version: "3.8"
 services:
  jupyter:
    image: jupyter/scipy-notebook:latest
    container_name: {{TOOL_NAME}}
    environment:
      - JUPYTER_ENABLE_LAB=yes
    volumes:
      - {{REPO_PATH}}:/home/jovyan/work
    ports:
      - "8888:8888"
    restart: unless-stopped""",
                "required_variables": ["REPO_PATH", "TOOL_NAME"],
            },
            {
                "name": "opencode",
                "display_name": "OpenCode",
                "description": "AI coding assistant - run opencode in terminal",
                "category": "ai-assistant",
                "interface_type": "terminal",
                "default_port": 3000,
                "compose_template": """version: "3.8"
 services:
  opencode:
    image: node:20-slim
    container_name: {{TOOL_NAME}}
    working_dir: /workspace
    environment:
      - HOME=/tmp
    volumes:
      - {{REPO_PATH}}:/workspace
      - opencode_home:/tmp
    ports:
      - "3000:3000"
    command: >
      sh -c "set -x &&
             apt-get update && apt-get install -y git ca-certificates &&
             echo 'Installing opencode...' &&
             npm install -g opencode-ai 2>&1 || echo 'ERROR: npm install failed' &&
             which opencode || echo 'ERROR: opencode not in PATH' &&
             npm bin -g &&
             ls -la $(npm bin -g) || echo 'ERROR: global bin dir not found' &&
             echo 'export PATH=\"$(npm bin -g):\\$PATH\"' >> /root/.bashrc &&
             echo 'cd /workspace' >> /root/.bashrc &&
             echo 'OpenCode installation complete' &&
             cd /workspace &&
             exec tail -f /dev/null"
    stdin_open: true
    tty: true
    restart: unless-stopped
 volumes:
  opencode_home:""",
                "required_variables": ["REPO_PATH", "TOOL_NAME"],
            },
        ]
        for tool_data in builtin_types:
            existing = await session.scalar(
                select(ToolType).where(ToolType.name == tool_data["name"])
            )
            if not existing:
                tool_type = ToolType(
                    name=tool_data["name"],
                    display_name=tool_data["display_name"],
                    description=tool_data["description"],
                    category=tool_data["category"],
                    interface_type=tool_data["interface_type"],
                    definition_type="compose",
                    compose_template=tool_data["compose_template"],
                    required_variables=tool_data["required_variables"],
                    default_port=tool_data["default_port"],
                )
                session.add(tool_type)
                logger.info("Created built-in tool type: %s", tool_data["name"])
            else:
                # Update existing built-in tool types to reflect code changes
                existing.display_name = tool_data["display_name"]
                existing.description = tool_data["description"]
                existing.category = tool_data["category"]
                existing.interface_type = tool_data["interface_type"]
                existing.definition_type = "compose"
                existing.compose_template = tool_data["compose_template"]
                existing.required_variables = tool_data["required_variables"]
                existing.default_port = tool_data["default_port"]
                logger.info("Updated built-in tool type: %s", tool_data["name"])
        await session.commit()
        logger.info("Built-in tool types seeded successfully.")
@@ -1,299 +0,0 @@
 """Config profile business logic."""
 import logging
 import uuid
 from fastapi import HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 from src.models.config_include import ConfigInclude
 from src.models.config_mount import ConfigMount
 from src.models.config_profile import ConfigProfile
 from src.models.tool_type import ToolType
 from src.models.user_config import UserConfig
 logger = logging.getLogger(__name__)
 MAX_INCLUDES_DEPTH = 10
 async def get_owned_profile(
    profile_id: uuid.UUID,
    user_id: uuid.UUID,
    session: AsyncSession,
 ) -> ConfigProfile:
    """Fetch a config profile and verify ownership."""
    profile = await session.get(ConfigProfile, profile_id)
    if profile is None or profile.user_id != user_id:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="config profile not found",
        )
    return profile
 async def _detect_cycle(
    session: AsyncSession,
    profile_id: uuid.UUID,
    visited: set[uuid.UUID] | None = None,
    depth: int = 0,
 ) -> bool:
    """Detect cycles in profile includes using DFS.
    Returns True if a cycle is detected.
    """
    if depth > MAX_INCLUDES_DEPTH:
        return True
    if visited is None:
        visited = set()
    if profile_id in visited:
        return True
    visited.add(profile_id)
    result = await session.execute(
        select(ConfigInclude.included_profile_id).where(
            ConfigInclude.profile_id == profile_id
        )
    )
    included_ids = result.scalars().all()
    for included_id in included_ids:
        if await _detect_cycle(session, included_id, visited.copy(), depth + 1):
            return True
    return False
 async def validate_includes_no_cycle(
    session: AsyncSession,
    profile_id: uuid.UUID,
    new_included_id: uuid.UUID | None = None,
 ) -> None:
    """Validate that adding an include wouldn't create a cycle."""
    if new_included_id and await _detect_cycle(session, new_included_id, {profile_id}):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="adding this include would create a circular reference",
        )
 # ---------------------------------------------------------------------------
 # Profile CRUD helpers
 # ---------------------------------------------------------------------------
 async def check_duplicate_name(
    session: AsyncSession,
    user_id: uuid.UUID,
    name: str,
    exclude_id: uuid.UUID | None = None,
 ) -> None:
    """Raise 409 if a profile with the given name already exists."""
    query = select(ConfigProfile).where(
        ConfigProfile.user_id == user_id,
        ConfigProfile.name == name,
    )
    if exclude_id:
        query = query.where(ConfigProfile.id != exclude_id)
    existing = await session.scalar(query)
    if existing:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail=f"config profile with name '{name}' already exists",
        )
 def profile_to_dict(profile: ConfigProfile) -> dict:
    """Serialize a ConfigProfile to a dict."""
    return {
        "id": str(profile.id),
        "user_id": str(profile.user_id),
        "name": profile.name,
        "description": profile.description,
        "created_at": profile.created_at.isoformat() if profile.created_at else None,
        "updated_at": profile.updated_at.isoformat() if profile.updated_at else None,
    }
 # ---------------------------------------------------------------------------
 # Include helpers
 # ---------------------------------------------------------------------------
 async def check_duplicate_include(
    session: AsyncSession,
    profile_id: uuid.UUID,
    included_profile_id: uuid.UUID,
 ) -> None:
    """Raise 409 if the include already exists."""
    existing = await session.scalar(
        select(ConfigInclude).where(
            ConfigInclude.profile_id == profile_id,
            ConfigInclude.included_profile_id == included_profile_id,
        )
    )
    if existing:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="this include already exists",
        )
 def include_to_dict(inc: ConfigInclude, included_name: str | None) -> dict:
    """Serialize a ConfigInclude to a dict."""
    return {
        "id": str(inc.id),
        "profile_id": str(inc.profile_id),
        "included_profile_id": str(inc.included_profile_id),
        "included_profile_name": included_name,
        "order_index": inc.order_index,
        "created_at": inc.created_at.isoformat() if inc.created_at else None,
        "updated_at": inc.updated_at.isoformat() if inc.updated_at else None,
    }
 # ---------------------------------------------------------------------------
 # Mount helpers
 # ---------------------------------------------------------------------------
 async def check_duplicate_mount_path(
    session: AsyncSession,
    profile_id: uuid.UUID,
    target_path: str,
    exclude_id: uuid.UUID | None = None,
 ) -> None:
    """Raise 409 if a mount with the given path already exists."""
    query = select(ConfigMount).where(
        ConfigMount.profile_id == profile_id,
        ConfigMount.target_path == target_path,
    )
    if exclude_id:
        query = query.where(ConfigMount.id != exclude_id)
    existing = await session.scalar(query)
    if existing:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail=f"mount with path '{target_path}' already exists",
        )
 def mount_to_dict(mount: ConfigMount) -> dict:
    """Serialize a ConfigMount to a dict."""
    return {
        "id": str(mount.id),
        "profile_id": str(mount.profile_id),
        "target_path": mount.target_path,
        "files": mount.files,
        "mode": mount.mode,
        "order_index": mount.order_index,
        "created_at": mount.created_at.isoformat() if mount.created_at else None,
        "updated_at": mount.updated_at.isoformat() if mount.updated_at else None,
    }
 # ---------------------------------------------------------------------------
 # Default profile helpers
 # ---------------------------------------------------------------------------
 async def get_or_create_user_config(
    session: AsyncSession,
    user_id: uuid.UUID,
 ) -> UserConfig:
    """Get existing user config or create a new one."""
    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
    user_config = result.scalar_one_or_none()
    if user_config is None:
        user_config = UserConfig(user_id=user_id, config={})
        session.add(user_config)
    return user_config
 async def validate_default_profiles(
    session: AsyncSession,
    user_id: uuid.UUID,
    default_profiles: dict[str, str],
 ) -> None:
    """Validate that all profile IDs in default_profiles belong to the user."""
    for tool_type_id, profile_id_str in default_profiles.items():
        profile = await session.get(ConfigProfile, uuid.UUID(profile_id_str))
        if profile is None:
            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=f"profile {profile_id_str} not found")
        if profile.user_id != user_id:
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=f"profile {profile_id_str} does not belong to user")
 async def get_default_profiles(
    session: AsyncSession,
    user_id: uuid.UUID,
 ) -> dict:
    """Get default profiles for a user."""
    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
    user_config = result.scalar_one_or_none()
    return {"default_profiles": user_config.default_profiles if user_config else {}}
 async def set_default_profiles(
    session: AsyncSession,
    user_id: uuid.UUID,
    default_profiles: dict[str, str],
 ) -> dict:
    """Set default profiles for a user."""
    user_config = await get_or_create_user_config(session, user_id)
    await validate_default_profiles(session, user_id, default_profiles)
    user_config.config = {**user_config.config, "default_profiles": default_profiles}
    await session.commit()
    await session.refresh(user_config)
    return {"default_profiles": user_config.default_profiles}
 async def get_default_profile_for_tool_type(
    session: AsyncSession,
    user_id: uuid.UUID,
    tool_type_id: str,
 ) -> dict:
    """Get default profile for a specific tool type."""
    result = await session.execute(select(UserConfig).where(UserConfig.user_id == user_id))
    user_config = result.scalar_one_or_none()
    profile_id = user_config.default_profiles.get(tool_type_id) if user_config else None
    return {"tool_type_id": tool_type_id, "profile_id": profile_id}
 # ---------------------------------------------------------------------------
 # Include list helper
 # ---------------------------------------------------------------------------
 async def list_includes_for_profile(
    session: AsyncSession,
    profile_id: uuid.UUID,
 ) -> dict:
    """List all includes for a profile."""
    result = await session.execute(
        select(ConfigInclude)
        .where(ConfigInclude.profile_id == profile_id)
        .order_by(ConfigInclude.order_index)
    )
    includes_data = []
    for inc in result.scalars().all():
        included_profile = await session.get(ConfigProfile, inc.included_profile_id)
        includes_data.append(include_to_dict(inc, included_profile.name if included_profile else None))
    return {"includes": includes_data}
 # ---------------------------------------------------------------------------
 # Mount list helper
 # ---------------------------------------------------------------------------
 async def list_mounts_for_profile(
    session: AsyncSession,
    profile_id: uuid.UUID,
 ) -> dict:
    """List all mounts for a profile."""
    result = await session.execute(
        select(ConfigMount)
        .where(ConfigMount.profile_id == profile_id)
        .order_by(ConfigMount.order_index)
    )
    return {"mounts": [mount_to_dict(m) for m in result.scalars().all()]}
@@ -0,0 +1,484 @@
 """Docker service for managing tool instances."""
 import logging
 import subprocess
 import time
 from collections import Counter
 from pathlib import Path
 from typing import Any
 logger = logging.getLogger(__name__)
 def sort_volumes_by_specificity(volumes: list[str]) -> list[str]:
    """Sort volume strings so parent paths come before child paths.
    Docker Compose mounts volumes in array order. A later mount at a parent
    path hides earlier mounts at child paths. By sorting shallow paths first
    and deep paths last, deeper (more specific) mounts overlay correctly.
    Volume format: source:target or source:target:type
    Args:
        volumes: List of Docker volume mount strings.
    Returns:
        Sorted list with parent paths before child paths.
    """
    def _target_depth(vol: str) -> int:
        parts = vol.split(":")
        if len(parts) < 2:
            return 0
        target = parts[1].rstrip("/")
        if not target or target == "/":
            return 0
        return target.count("/")
    # Detect duplicate targets and warn
    targets = []
    for vol in volumes:
        parts = vol.split(":")
        targets.append(parts[1] if len(parts) > 1 else "")
    dupes = [t for t, c in Counter(targets).items() if c > 1]
    if dupes:
        logger.warning("Duplicate mount targets detected: %s", dupes)
    # Stable sort: parent paths first, child paths last
    return sorted(volumes, key=_target_depth)
 def render_compose_template(template: str, variables: dict[str, Any]) -> str:
    """Render a Docker Compose template with variable substitution.
    Args:
        template: The compose template string
        variables: Dictionary of variable names to values
    Returns:
        Rendered compose file content
    """
    result = template
    for key, value in variables.items():
        placeholder = f"{{{{{key}}}}}"
        result = result.replace(placeholder, str(value))
    return result
 def ensure_instance_directory(instance_id: str, base_path: str | None = None) -> str:
    """Create and return the instance directory path.
    Args:
        instance_id: Unique instance identifier
        base_path: Base directory for all instances (defaults to Settings.instance_base_path)
    Returns:
        Absolute path to instance directory
    """
    if base_path is None:
        from src.config import Settings
        base_path = Settings().instance_base_path
    instance_dir = Path(base_path) / instance_id
    instance_dir.mkdir(parents=True, exist_ok=True)
    return str(instance_dir.absolute())
 def write_compose_file(instance_dir: str, content: str) -> str:
    """Write the rendered compose file to the instance directory.
    Args:
        instance_dir: Path to instance directory
        content: Rendered compose content
    Returns:
        Path to the compose file
    """
    compose_path = Path(instance_dir) / "docker-compose.yml"
    compose_path.write_text(content)
    return str(compose_path)
 def write_env_file(instance_dir: str, env_vars: dict[str, str]) -> str:
    """Write environment variables to a .env file.
    Args:
        instance_dir: Path to instance directory
        env_vars: Dictionary of env var names to values
    Returns:
        Path to the env file
    """
    env_path = Path(instance_dir) / ".env"
    lines = [f'{key}="{value}"' for key, value in env_vars.items()]
    env_path.write_text("\n".join(lines) + "\n")
    return str(env_path)
 def write_config_files(instance_dir: str, files: dict[str, str]) -> None:
    """Write config files to the instance directory.
    Args:
        instance_dir: Path to instance directory
        files: Dictionary of file paths (relative to instance dir) to content
    """
    instance_path = Path(instance_dir)
    for file_path, content in files.items():
        # Ensure the path is within the instance directory (security)
        full_path = instance_path / file_path
        try:
            full_path.resolve().relative_to(instance_path.resolve())
        except ValueError:
            raise ValueError(f"File path '{file_path}' escapes instance directory")
        full_path.parent.mkdir(parents=True, exist_ok=True)
        full_path.write_text(content)
 def execute_compose_command(
    compose_path: str, action: str, timeout: int = 60, env_file: str | None = None
 ) -> tuple[int, str, str]:
    """Execute a docker compose command.
    Args:
        compose_path: Path to docker-compose.yml
        action: The compose action (up, down, start, stop, restart)
        timeout: Command timeout in seconds
        env_file: Optional path to .env file for environment variables
    Returns:
        Tuple of (returncode, stdout, stderr)
    """
    instance_dir = Path(compose_path).parent
    cmd = ["docker", "compose", "-f", compose_path]
    if env_file:
        cmd.extend(["--env-file", env_file])
    if action == "up":
        cmd.extend(["up", "-d", "--force-recreate"])
    elif action == "down":
        cmd.extend(["down", "-v"])
    elif action in ("start", "stop", "restart"):
        cmd.append(action)
    else:
        raise ValueError(f"Unknown compose action: {action}")
    result = subprocess.run(
        cmd,
        cwd=str(instance_dir),
        capture_output=True,
        text=True,
        timeout=timeout,
    )
    return result.returncode, result.stdout, result.stderr
 def get_container_id(instance_name: str) -> str | None:
    """Get the container ID for a compose service.
    Uses exact name matching to avoid substring collisions with tunnel
    containers (e.g. tunnel-code-server-... matching code-server-...).
    Falls back to case-insensitive matching since Docker DNS is case-
    insensitive but docker inspect is case-sensitive.
    Args:
        instance_name: The expected container name.
    Returns:
        Container ID or None if not found.
    """
    expected = instance_name.lower()
    # Fast path: exact match via docker inspect
    result = subprocess.run(
        ["docker", "inspect", "-f", "{{.Id}}", expected],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0 and result.stdout.strip():
        return result.stdout.strip()
    # Fallback: list all containers and do case-insensitive exact match
    ps_result = subprocess.run(
        ["docker", "ps", "-a", "--format", "{{.Names}}\t{{.ID}}"],
        capture_output=True,
        text=True,
    )
    if ps_result.returncode == 0:
        for line in ps_result.stdout.strip().splitlines():
            parts = line.split("\t")
            if len(parts) == 2:
                name, cid = parts
                if name.lower() == expected:
                    return cid
    return None
 def get_container_name(instance_name: str) -> str | None:
    """Get the full container name for a compose service.
    Uses exact name matching via docker inspect to avoid substring collisions.
    Args:
        instance_name: The exact container name (case-insensitive for Docker).
    Returns:
        Container name or None if not found.
    """
    result = subprocess.run(
        ["docker", "inspect", "-f", "{{.Name}}", instance_name.lower()],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0 and result.stdout.strip():
        return result.stdout.strip().lstrip("/")
    return None
 def get_backend_network_name() -> str:
    """Auto-detect the actual Docker network name for the backend network.
    Docker Compose prefixes network names with the project directory name
    (e.g. 'headquarter_backend' instead of 'backend'). We inspect the API
    container itself to find the real network name it's connected to.
    Returns:
        The actual Docker network name, or 'backend' as fallback.
    """
    # Try to find the API container by its known name
    api_container = "hq-api"
    result = subprocess.run(
        [
            "docker",
            "inspect",
            "-f",
            "{{range $k, $v := .NetworkSettings.Networks}}{{$k}} {{end}}",
            api_container,
        ],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0 and result.stdout.strip():
        networks = result.stdout.strip().split()
        for net in networks:
            if "backend" in net.lower():
                return net
        # API container is on some network — return the first one
        return networks[0]
    return "backend"
 def connect_container_to_network(
    container_name: str, network_name: str | None = None
 ) -> bool:
    """Connect a Docker container to an existing network.
    Args:
        container_name: Name or ID of the container
        network_name: Name of the Docker network. If None, auto-detects
            from the API container's own network membership.
    Returns:
        True if successful, False otherwise
    """
    if network_name is None:
        network_name = get_backend_network_name()
    result = subprocess.run(
        ["docker", "network", "connect", network_name, container_name],
        capture_output=True,
        text=True,
    )
    return result.returncode == 0
 def get_container_ip_on_network(
    container_id: str, network_name: str | None = None
 ) -> str | None:
    """Get a container's IP address on a specific Docker network.
    Args:
        container_id: Docker container ID or name.
        network_name: Network name. If None, auto-detects from the API container.
    Returns:
        IP address string, or None if the container is not on that network.
    """
    if network_name is None:
        network_name = get_backend_network_name()
    result = subprocess.run(
        [
            "docker",
            "inspect",
            "-f",
            f"{{{{.NetworkSettings.Networks.{network_name}.IPAddress}}}}",
            container_id,
        ],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0:
        ip = result.stdout.strip()
        if ip and ip != "<no value>":
            return ip
    return None
 def is_container_on_network(container_id: str, network_name: str | None = None) -> bool:
    """Check whether a container is already attached to a Docker network.
    Args:
        container_id: Docker container ID or name.
        network_name: Network name. If None, auto-detects from the API container.
    Returns:
        True if the container is on the network.
    """
    if network_name is None:
        network_name = get_backend_network_name()
    result = subprocess.run(
        [
            "docker",
            "inspect",
            "-f",
            f"{{{{.NetworkSettings.Networks.{network_name}}}}}",
            container_id,
        ],
        capture_output=True,
        text=True,
    )
    return result.returncode == 0 and "<no value>" not in result.stdout
 def get_container_status(container_id: str) -> dict[str, Any]:
    """Get the status of a Docker container.
    Args:
        container_id: Docker container ID
    Returns:
        Dict with 'status' (running, exited, restarting, not_found),
        'exit_code' (int or None), and 'health' (health status or None)
    """
    result = subprocess.run(
        [
            "docker",
            "inspect",
            "-f",
            "{{.State.Status}}|{{.State.ExitCode}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}",
            container_id,
        ],
        capture_output=True,
        text=True,
    )
    if result.returncode != 0:
        return {"status": "not_found", "exit_code": None, "health": None}
    parts = result.stdout.strip().split("|")
    status = parts[0] if parts else "unknown"
    exit_code = int(parts[1]) if len(parts) > 1 and parts[1].isdigit() else None
    health = parts[2] if len(parts) > 2 and parts[2] != "none" else None
    return {"status": status, "exit_code": exit_code, "health": health}
 def wait_for_container_running(
    container_id: str, timeout: int = 30, interval: float = 2.0
 ) -> dict[str, Any]:
    """Wait for a container to reach the running state.
    Polls docker inspect until the container status is "running" or timeout.
    Args:
        container_id: Docker container ID
        timeout: Maximum seconds to wait
        interval: Seconds between polls
    Returns:
        Dict with 'success' (bool), 'status' (str), 'exit_code' (int or None),
        and 'waited_seconds' (float)
    """
    start_time = time.time()
    while time.time() - start_time < timeout:
        info = get_container_status(container_id)
        if info["status"] == "running":
            return {
                "success": True,
                "status": "running",
                "exit_code": None,
                "waited_seconds": time.time() - start_time,
            }
        if info["status"] == "exited":
            return {
                "success": False,
                "status": "exited",
                "exit_code": info["exit_code"],
                "waited_seconds": time.time() - start_time,
            }
        if info["status"] == "not_found":
            return {
                "success": False,
                "status": "not_found",
                "exit_code": None,
                "waited_seconds": time.time() - start_time,
            }
        time.sleep(interval)
    # Timeout reached
    info = get_container_status(container_id)
    return {
        "success": False,
        "status": info["status"],
        "exit_code": info["exit_code"],
        "waited_seconds": time.time() - start_time,
    }
 def get_container_logs(container_id: str, tail: int = 100) -> str:
    """Get the logs of a Docker container.
    Args:
        container_id: Docker container ID
        tail: Number of lines to return
    Returns:
        Container logs
    """
    result = subprocess.run(
        ["docker", "logs", "--tail", str(tail), container_id],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0:
        return result.stdout
    return f"Failed to get logs: {result.stderr}"
 def find_free_port(start: int = 10000, end: int = 20000) -> int:
    """Find a free TCP port in the given range.
    Args:
        start: Start of port range
        end: End of port range
    Returns:
        Free port number
    """
    import socket
    for port in range(start, end):
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            if s.connect_ex(("localhost", port)) != 0:
                return port
    raise RuntimeError(f"No free port found in range {start}-{end}")
@@ -1,43 +0,0 @@
 """Docker services for container and tunnel management."""
 from .compose import (
    ensure_instance_directory,
    execute_compose_command,
    render_compose_template,
    write_compose_file,
    write_env_file,
 )
 from .config_staging import write_config_files
 from .container import (
    connect_container_to_network,
    find_free_port,
    get_container_id,
    get_container_logs,
    get_container_name,
    get_container_status,
 )
 from .tunnel import (
    check_tunnel_health,
    recreate_tunnel,
    start_cloudflared_tunnel,
    stop_cloudflared_tunnel,
 )
 __all__ = [
    "render_compose_template",
    "ensure_instance_directory",
    "write_compose_file",
    "write_env_file",
    "execute_compose_command",
    "write_config_files",
    "get_container_id",
    "get_container_name",
    "connect_container_to_network",
    "get_container_status",
    "get_container_logs",
    "find_free_port",
    "start_cloudflared_tunnel",
    "stop_cloudflared_tunnel",
    "recreate_tunnel",
    "check_tunnel_health",
 ]
@@ -1,237 +0,0 @@
 """Docker Compose file generation and command execution."""
 import re
 import subprocess
 import uuid
 from pathlib import Path
 from typing import Any
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from src.models.config_profile import ConfigProfile
 from src.models.tool_instance import ToolInstance
 from src.services.profile_resolver import resolve_profile
 def _sanitize_name(name: str) -> str:
    """Sanitize a string for use in Docker/container names."""
    sanitized = re.sub(r"[^a-z0-9-]", "-", name.lower())
    sanitized = re.sub(r"-+", "-", sanitized)
    return sanitized.strip("-")
 async def _generate_instance_name(
    session: AsyncSession,
    project_name: str,
    tool_type_name: str,
 ) -> str:
    """Generate a unique instance name: project-tool-NUM."""
    base = f"{_sanitize_name(project_name)}-{_sanitize_name(tool_type_name)}"
    base = base.strip("-") or "instance"
    result = await session.execute(
        select(ToolInstance.name).where(ToolInstance.name.like(f"{base}-%"))
    )
    names = result.scalars().all()
    max_num = 0
    for name in names:
        parts = name.rsplit("-", 1)
        if len(parts) == 2 and parts[0] == base and parts[1].isdigit():
            max_num = max(max_num, int(parts[1]))
    return f"{base}-{max_num + 1:03d}"
 def _modify_compose_file(
    compose_path: str,
    port_override: int | None = None,
    start_command: str | None = None,
    working_directory: str | None = None,
    extra_volumes: list[dict] | None = None,
 ) -> None:
    """Modify compose file with runtime overrides."""
    import yaml
    compose_file = Path(compose_path)
    content = compose_file.read_text()
    compose_data = yaml.safe_load(content)
    if not compose_data or "services" not in compose_data:
        return
    for service_name, service_config in compose_data["services"].items():
        if port_override and "ports" in service_config:
            for i, port_mapping in enumerate(service_config["ports"]):
                if isinstance(port_mapping, str) and ":" in port_mapping:
                    _host_port, container_port = port_mapping.split(":", 1)
                    service_config["ports"][i] = f"{port_override}:{container_port}"
                    break
        if start_command:
            service_config["command"] = start_command
        if working_directory:
            service_config["working_dir"] = working_directory
        if extra_volumes:
            if "volumes" not in service_config:
                service_config["volumes"] = []
            for vol in extra_volumes:
                source = vol.get("source", "")
                target = vol.get("target", "")
                vol_type = vol.get("type", "bind")
                if vol_type == "bind":
                    service_config["volumes"].append(f"{source}:{target}")
                else:
                    service_config["volumes"].append(f"{source}:{target}:{vol_type}")
        break
    compose_file.write_text(yaml.dump(compose_data, default_flow_style=False))
 async def _apply_resolved_profile(
    profile: ConfigProfile,
    instance_dir: str,
    env_vars: dict[str, str],
    port_override: int | None,
    start_command: str | None,
    working_directory: str | None,
    extra_volumes: list[dict],
 ) -> tuple[dict[str, str], int | None, str | None, str | None, list[dict]]:
    """Resolve a profile and apply its output to instance configuration."""
    resolved = resolve_profile(profile)
    if resolved.environment_variables:
        env_vars.update(resolved.environment_variables)
    if resolved.runtime_hints.start_command is not None:
        start_command = resolved.runtime_hints.start_command
    if resolved.runtime_hints.working_directory is not None:
        working_directory = resolved.runtime_hints.working_directory
    if resolved.runtime_hints.port is not None:
        port_override = resolved.runtime_hints.port
    for target_path, mount in resolved.mounts.items():
        safe_name = target_path.strip("/").replace("/", "_")
        mount_dir = Path(instance_dir) / "mounts" / safe_name
        mount_dir.mkdir(parents=True, exist_ok=True)
        for rel_path, content in mount.files.items():
            file_path = mount_dir / rel_path
            file_path.parent.mkdir(parents=True, exist_ok=True)
            file_path.write_text(content)
        extra_volumes.append({
            "source": str(mount_dir),
            "target": target_path,
            "type": mount.mode,
        })
    return env_vars, port_override, start_command, working_directory, extra_volumes
 def render_compose_template(template: str, variables: dict[str, Any]) -> str:
    """Render a Docker Compose template with variable substitution.
    Args:
        template: The compose template string
        variables: Dictionary of variable names to values
    Returns:
        Rendered compose file content
    """
    result = template
    for key, value in variables.items():
        placeholder = f"{{{{{key}}}}}"
        result = result.replace(placeholder, str(value))
    return result
 def ensure_instance_directory(instance_id: str, base_path: str | None = None) -> str:
    """Create and return the instance directory path.
    Args:
        instance_id: Unique instance identifier
        base_path: Base directory for all instances (defaults to Settings.instance_base_path)
    Returns:
        Absolute path to instance directory
    """
    if base_path is None:
        from src.config import Settings
        base_path = Settings().instance_base_path
    instance_dir = Path(base_path) / instance_id
    instance_dir.mkdir(parents=True, exist_ok=True)
    return str(instance_dir.absolute())
 def write_compose_file(instance_dir: str, content: str) -> str:
    """Write the rendered compose file to the instance directory.
    Args:
        instance_dir: Path to instance directory
        content: Rendered compose content
    Returns:
        Path to the compose file
    """
    compose_path = Path(instance_dir) / "docker-compose.yml"
    compose_path.write_text(content)
    return str(compose_path)
 def write_env_file(instance_dir: str, env_vars: dict[str, str]) -> str:
    """Write environment variables to a .env file.
    Args:
        instance_dir: Path to instance directory
        env_vars: Dictionary of env var names to values
    Returns:
        Path to the env file
    """
    env_path = Path(instance_dir) / ".env"
    lines = [f'{key}="{value}"' for key, value in env_vars.items()]
    env_path.write_text("\n".join(lines) + "\n")
    return str(env_path)
 def execute_compose_command(
    compose_path: str, action: str, timeout: int = 60, env_file: str | None = None
 ) -> tuple[int, str, str]:
    """Execute a docker compose command.
    Args:
        compose_path: Path to docker-compose.yml
        action: The compose action (up, down, start, stop, restart)
        timeout: Command timeout in seconds
        env_file: Optional path to .env file for environment variables
    Returns:
        Tuple of (returncode, stdout, stderr)
    """
    instance_dir = Path(compose_path).parent
    cmd = ["docker", "compose", "-f", compose_path]
    if env_file:
        cmd.extend(["--env-file", env_file])
    if action == "up":
        cmd.extend(["up", "-d"])
    elif action == "down":
        cmd.extend(["down", "-v"])
    elif action in ("start", "stop", "restart"):
        cmd.append(action)
    else:
        raise ValueError(f"Unknown compose action: {action}")
    result = subprocess.run(
        cmd,
        cwd=str(instance_dir),
        capture_output=True,
        text=True,
        timeout=timeout,
    )
    return result.returncode, result.stdout, result.stderr
@@ -1,22 +0,0 @@
 """Config file staging for Docker instances."""
 from pathlib import Path
 def write_config_files(instance_dir: str, files: dict[str, str]) -> None:
    """Write config files to the instance directory.
    Args:
        instance_dir: Path to instance directory
        files: Dictionary of file paths (relative to instance dir) to content
    """
    instance_path = Path(instance_dir)
    for file_path, content in files.items():
        # Ensure the path is within the instance directory (security)
        full_path = instance_path / file_path
        try:
            full_path.resolve().relative_to(instance_path.resolve())
        except ValueError:
            raise ValueError(f"File path '{file_path}' escapes instance directory")
        full_path.parent.mkdir(parents=True, exist_ok=True)
        full_path.write_text(content)
@@ -1,121 +0,0 @@
 """Docker container lifecycle and query operations."""
 import socket
 import subprocess
 def get_container_id(instance_name: str) -> str | None:
    """Get the container ID for a compose service.
    Args:
        instance_name: The service name in compose
    Returns:
        Container ID or None if not found
    """
    result = subprocess.run(
        ["docker", "ps", "-q", "--filter", f"name={instance_name}"],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0 and result.stdout.strip():
        return result.stdout.strip().split("\n")[0]
    return None
 def get_container_name(instance_name: str) -> str | None:
    """Get the full container name for a compose service.
    Args:
        instance_name: The service name in compose
    Returns:
        Container name or None if not found
    """
    result = subprocess.run(
        ["docker", "ps", "--format", "{{.Names}}", "--filter", f"name={instance_name}"],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0 and result.stdout.strip():
        return result.stdout.strip().split("\n")[0]
    return None
 def connect_container_to_network(container_name: str, network_name: str = "backend") -> bool:
    """Connect a Docker container to an existing network.
    Args:
        container_name: Name or ID of the container
        network_name: Name of the Docker network (default: backend)
    Returns:
        True if successful, False otherwise
    """
    result = subprocess.run(
        ["docker", "network", "connect", network_name, container_name],
        capture_output=True,
        text=True,
    )
    return result.returncode == 0
 def get_container_status(container_id: str) -> str:
    """Get the status of a Docker container.
    Args:
        container_id: Docker container ID
    Returns:
        Container status string (running, exited, etc.)
    """
    result = subprocess.run(
        ["docker", "inspect", "-f", "{{.State.Status}}", container_id],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0:
        return result.stdout.strip()
    return "unknown"
 def get_container_logs(container_id: str, tail: int = 100) -> str:
    """Get the logs of a Docker container.
    Args:
        container_id: Docker container ID
        tail: Number of lines to return
    Returns:
        Container logs
    """
    result = subprocess.run(
        ["docker", "logs", "--tail", str(tail), container_id],
        capture_output=True,
        text=True,
    )
    if result.returncode == 0:
        return result.stdout
    return f"Failed to get logs: {result.stderr}"
 def find_free_port(start: int = 10000, end: int = 20000) -> int:
    """Find a free TCP port in the given range.
    Args:
        start: Start of port range
        end: End of port range
    Returns:
        Free port number
    """
    for port in range(start, end):
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            if s.connect_ex(("localhost", port)) != 0:
                return port
    raise RuntimeError(f"No free port found in range {start}-{end}")
@@ -1,146 +0,0 @@
 """Cloudflare tunnel management for Docker instances."""
 import logging
 import os
 import re
 import signal
 import subprocess
 import time
 from typing import Any
 logger = logging.getLogger(__name__)
 def start_cloudflared_tunnel(
    container_name: str, port: int, timeout: int = 30
 ) -> dict[str, str]:
    """Start a temporary Cloudflare tunnel for a container.
    Uses 'cloudflared tunnel --url' to create a temporary tunnel
    with a random trycloudflare.com URL.
    Args:
        container_name: Name of the Docker container to tunnel to
        port: Port number the container listens on
        timeout: Maximum seconds to wait for tunnel URL
    Returns:
        Dict with 'url' (the public tunnel URL) and 'pid' (process ID)
    """
    import select as sel
    # First verify the container is accessible
    logger.info("Checking connectivity to %s:%d...", container_name, port)
    for attempt in range(10):
        check = subprocess.run(
            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
             f"http://{container_name}:{port}"],
            capture_output=True,
            text=True,
            timeout=5,
        )
        logger.info("Connectivity check %d: http_code=%s", attempt + 1, check.stdout.strip())
        if check.returncode == 0:
            break
        time.sleep(1)
    else:
        logger.warning("Container %s:%d not responding to curl checks", container_name, port)
    # Run cloudflared in background, capture output
    logger.info("Starting cloudflared tunnel to http://%s:%d", container_name, port)
    proc = subprocess.Popen(
        ["cloudflared", "tunnel", "--url", f"http://{container_name}:{port}"],
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        text=True,
    )
    # Wait for the URL to appear in output
    url_pattern = re.compile(r"https://[a-z0-9-]+\.trycloudflare\.com")
    start_time = time.time()
    url = None
    while time.time() - start_time < timeout:
        # Read available output
        readable, _, _ = sel.select([proc.stdout], [], [], 1.0)
        if readable:
            line = proc.stdout.readline()
            if line:
                match = url_pattern.search(line)
                if match:
                    url = match.group(0)
                    break
    if not url:
        proc.terminate()
        proc.wait(timeout=5)
        raise RuntimeError(
            f"Failed to get tunnel URL within {timeout}s. "
            f"cloudflared output may contain errors."
        )
    return {"url": url, "pid": str(proc.pid)}
 def stop_cloudflared_tunnel(pid: str) -> None:
    """Stop a cloudflared tunnel process.
    Args:
        pid: Process ID of the cloudflared tunnel
    """
    try:
        os.kill(int(pid), signal.SIGTERM)
    except ProcessLookupError:
        pass  # Already stopped
 def recreate_tunnel(
    container_name: str, port: int, old_pid: str | None = None
 ) -> dict[str, str]:
    """Recreate a temporary Cloudflare tunnel.
    Stops the old tunnel (if pid provided) and starts a new one.
    Args:
        container_name: Name of the Docker container to tunnel to
        port: Port number the container listens on
        old_pid: Optional PID of the old tunnel process to stop
    Returns:
        Dict with 'url' and 'pid' for the new tunnel
    """
    if old_pid:
        stop_cloudflared_tunnel(old_pid)
    return start_cloudflared_tunnel(container_name, port)
 def check_tunnel_health(url: str, timeout: int = 10) -> dict[str, Any]:
    """Check if a tunnel URL is healthy.
    Args:
        url: The tunnel URL to check
        timeout: Request timeout in seconds
    Returns:
        Dict with 'healthy' (bool) and 'status_code' (int or None)
    """
    try:
        result = subprocess.run(
            ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
             "--max-time", str(timeout), url],
            capture_output=True,
            text=True,
            timeout=timeout + 5,
        )
        status_code = int(result.stdout.strip())
        return {
            "healthy": 200 <= status_code < 400,
            "status_code": status_code,
        }
    except (ValueError, subprocess.TimeoutExpired, Exception) as e:
        return {
            "healthy": False,
            "status_code": None,
            "error": str(e),
        }
@@ -1 +0,0 @@
 """Git services package."""
@@ -1,196 +0,0 @@
 """Git control operations with repo validation."""
 import logging
 import os
 import uuid
 from fastapi import HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 from src.models.git_repository import GitRepository
 from src.models.user import User
 from src.schemas.git_repository import (
    BranchCreateRequest,
    CheckoutRequest,
    CommitRequest,
    FetchResponse,
    MergeRequest,
    MergeResponse,
    PullResponse,
    PushResponse,
    StatusResponse,
 )
 from src.services.git.repository import ensure_repo_on_disk, get_repo_and_validate
 from src.utils.git_control import (
    checkout_branch,
    commit_changes,
    create_branch,
    delete_branch,
    fetch,
    get_status,
    merge,
    pull,
    push,
 )
 logger = logging.getLogger(__name__)
 async def get_status_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
 ) -> StatusResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        result = get_status(repo.path)
        return StatusResponse(
            branch=result.branch,
            modified=result.modified,
            added=result.added,
            deleted=result.deleted,
            untracked=result.untracked,
            renamed=result.renamed,
            ahead=result.ahead,
            behind=result.behind,
        )
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def create_branch_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    data: BranchCreateRequest,
 ) -> dict:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        create_branch(repo.path, data.name, data.base_branch)
        return {"message": f"Branch '{data.name}' created", "branch": data.name}
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def delete_branch_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    branch_name: str,
    force: bool = False,
 ) -> dict:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        delete_branch(repo.path, branch_name, force)
        return {"message": f"Branch '{branch_name}' deleted"}
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def checkout_branch_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    data: CheckoutRequest,
 ) -> dict:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        checkout_branch(repo.path, data.branch)
        return {"message": f"Checked out branch '{data.branch}'", "branch": data.branch}
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def commit_changes_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    data: CommitRequest,
    user: User,
 ) -> dict:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    author_name = user.name or "Unknown"
    author_email = user.email or "unknown@example.com"
    try:
        commit_hash = commit_changes(
            repo_path=repo.path,
            message=data.message,
            author_name=author_name,
            author_email=author_email,
            files=data.files,
        )
        return {"commit_hash": commit_hash, "message": data.message}
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def fetch_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
 ) -> FetchResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        fetch(repo.path)
        return FetchResponse(message="Fetched from remote")
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def pull_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    branch: str | None = None,
 ) -> PullResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        pull(repo.path, branch)
        return PullResponse(message="Pulled from remote")
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def push_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    branch: str | None = None,
 ) -> PushResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        push(repo.path, branch)
        return PushResponse(message="Pushed to remote")
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def merge_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    data: MergeRequest,
 ) -> MergeResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        commit_hash = merge(
            repo_path=repo.path,
            source_branch=data.source_branch,
            target_branch=data.target_branch,
            message=data.message,
        )
        return MergeResponse(
            commit_hash=commit_hash,
            message=data.message or f"Merge {data.source_branch}",
        )
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
@@ -1,150 +0,0 @@
 """Git file operations with repo validation."""
 import logging
 import uuid
 from fastapi import HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 from src.models.git_repository import GitRepository
 from src.models.user import User
 from src.schemas.git_repository import (
    FileContentResponse,
    FileListResponse,
    FileUpdateRequest,
    FileUpdateResponse,
 )
 from src.services.git.repository import ensure_repo_on_disk, get_repo_and_validate
 from src.utils.git_files import (
    commit_file,
    get_file_content,
    list_branches,
    list_tree,
 )
 logger = logging.getLogger(__name__)
 async def list_files(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    branch: str = "main",
    path: str = "",
 ) -> FileListResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        entries = list_tree(repo.path, branch=branch, path=path)
        return FileListResponse(
            path=path,
            branch=branch,
            entries=[
                {
                    "name": e.name,
                    "type": e.type,
                    "path": e.path,
                    "size": e.size,
                    "mode": e.mode,
                    "last_commit": e.last_commit,
                }
                for e in entries
            ],
        )
    except RuntimeError as e:
        logger.error(
            "Failed to list files for repo %s (path=%s, branch=%s): %s",
            repo_id,
            path,
            branch,
            str(e),
            exc_info=True,
        )
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def get_file(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    branch: str,
    path: str,
 ) -> FileContentResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        file_content = get_file_content(repo.path, branch=branch, path=path)
        return FileContentResponse(
            path=file_content.path,
            branch=file_content.branch,
            content=file_content.content,
            size=file_content.size,
            encoding=file_content.encoding,
            language=file_content.language,
            is_binary=file_content.is_binary,
            last_commit=file_content.last_commit,
        )
    except FileNotFoundError:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="file not found")
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def update_file(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
    data: FileUpdateRequest,
    user: User,
 ) -> FileUpdateResponse:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    author_name = user.name or "Unknown"
    author_email = user.email or "unknown@example.com"
    try:
        commit_hash = commit_file(
            repo_path=repo.path,
            branch=data.branch,
            path=data.path,
            content=data.content,
            commit_message=data.commit_message,
            author_name=author_name,
            author_email=author_email,
        )
        return FileUpdateResponse(
            commit_hash=commit_hash,
            message=data.commit_message,
            branch=data.branch,
        )
    except RuntimeError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 async def list_branches_with_validation(
    session: AsyncSession,
    project_id: uuid.UUID,
    repo_id: uuid.UUID,
 ) -> dict:
    repo = await get_repo_and_validate(session, repo_id, project_id)
    ensure_repo_on_disk(repo)
    try:
        branches, default_branch = list_branches(repo.path)
        return {
            "branches": [
                {
                    "name": b.name,
                    "is_default": b.is_default,
                    "last_commit": b.last_commit,
                }
                for b in branches
            ],
            "default_branch": default_branch,
        }
    except RuntimeError as e:
        logger.error(
            "Failed to list branches for repo %s: %s",
            repo_id,
            str(e),
            exc_info=True,
        )
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
@@ -1,211 +0,0 @@
 """Repository lifecycle and path helpers."""
 import logging
 import os
 import shutil
 import subprocess
 import uuid
 from fastapi import HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from src.config import Settings
 from src.models.git_repository import GitRepository
 from src.models.project import Project
 from src.models.user import User
 from src.schemas.git_repository import GitRepositoryCreate
 from src.utils.git_url_parser import parse_git_url
 logger = logging.getLogger(__name__)
 def _get_repo_path(user_id: uuid.UUID, project_id: uuid.UUID, name: str) -> str:
    """Generate the filesystem path for a repository."""
    base = Settings().repo_base_path or "/data/repos"
    return os.path.join(base, str(user_id), str(project_id), f"{name}.git")
 def _build_provider_clone_url(owner: str, repo: str) -> str:
    """Build the SSH clone URL for the fixed git provider."""
    return f"git@git.commumedia.org:{owner}/{repo}.git"
 def _preflight_remote_repository(remote_url: str) -> None:
    """Verify a remote repository is reachable before cloning."""
    try:
        result = subprocess.run(
            ["git", "ls-remote", remote_url],
            capture_output=True,
            text=True,
            timeout=60,
        )
    except subprocess.TimeoutExpired:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="remote repository check timed out")
    except FileNotFoundError:
        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
    if result.returncode != 0:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="repository not found or inaccessible",
        )
 def _clone_working_repository(remote_url: str, repo_path: str) -> None:
    try:
        result = subprocess.run(
            ["git", "clone", remote_url, repo_path],
            capture_output=True,
            text=True,
            timeout=300,
        )
    except subprocess.TimeoutExpired:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="clone operation timed out")
    except FileNotFoundError:
        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
    if result.returncode != 0:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"failed to clone repository: {result.stderr}",
        )
 def _init_working_repository(repo_path: str) -> None:
    try:
        result = subprocess.run(
            ["git", "init", "-b", "main", repo_path],
            capture_output=True,
            text=True,
        )
    except FileNotFoundError:
        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="git command not found")
    if result.returncode == 0:
        return
    fallback = subprocess.run(
        ["git", "init", repo_path],
        capture_output=True,
        text=True,
    )
    if fallback.returncode != 0:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"failed to initialize repository: {fallback.stderr}",
        )
    ref_result = subprocess.run(
        ["git", "-C", repo_path, "symbolic-ref", "HEAD", "refs/heads/main"],
        capture_output=True,
        text=True,
    )
    if ref_result.returncode != 0:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=f"failed to set initial branch: {ref_result.stderr}",
        )
 async def get_repo_and_validate(
    session: AsyncSession,
    repo_id: uuid.UUID,
    project_id: uuid.UUID,
 ) -> GitRepository:
    """Fetch a repository and validate ownership + disk presence."""
    repo = await session.get(GitRepository, repo_id)
    if repo is None or repo.project_id != project_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="repository not found")
    return repo
 def ensure_repo_on_disk(repo: GitRepository) -> None:
    """Raise 404 if the repository is not present on disk."""
    if not os.path.exists(repo.path):
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="repository not found on disk")
 async def create_repository(
    session: AsyncSession,
    project_id: uuid.UUID,
    data: GitRepositoryCreate,
    user: User,
 ) -> GitRepository:
    """Create a new git repository (clone or init)."""
    # Check for duplicate name
    existing = await session.execute(
        select(GitRepository).where(
            GitRepository.project_id == project_id,
            GitRepository.name == data.name,
        )
    )
    if existing.scalar_one_or_none():
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="repository name already exists")
    # Validate and potentially correct the URL
    remote_url = data.remote_url
    if remote_url and not data.force_original_url:
        parse_result = parse_git_url(remote_url)
        if parse_result["needs_parsing"] and parse_result["base_url"]:
            raise HTTPException(
                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
                detail={
                    "message": "The provided URL appears to be a browser URL, not a git clone URL",
                    "suggested_url": parse_result["base_url"],
                    "original_url": remote_url,
                    "error_code": "URL_NEEDS_PARSING",
                },
            )
        if parse_result["base_url"]:
            remote_url = parse_result["base_url"]
    if remote_url:
        _preflight_remote_repository(remote_url)
    repo_path = _get_repo_path(user.id, project_id, data.name)
    os.makedirs(os.path.dirname(repo_path), exist_ok=True)
    if remote_url:
        _clone_working_repository(remote_url, repo_path)
    else:
        _init_working_repository(repo_path)
    repo = GitRepository(
        name=data.name,
        path=repo_path,
        project_id=project_id,
        owner_id=user.id,
        is_mirror=False,
        remote_url=remote_url,
    )
    session.add(repo)
    await session.commit()
    await session.refresh(repo)
    return repo
 async def delete_repository(
    session: AsyncSession,
    repo_id: uuid.UUID,
    project_id: uuid.UUID,
 ) -> None:
    """Delete a repository from DB and disk."""
    repo = await get_repo_and_validate(session, repo_id, project_id)
    if os.path.exists(repo.path):
        shutil.rmtree(repo.path)
    await session.delete(repo)
    await session.commit()
 async def list_repositories(
    session: AsyncSession,
    project_id: uuid.UUID,
 ) -> list[GitRepository]:
    """List all repositories in a project."""
    result = await session.execute(
        select(GitRepository).where(GitRepository.project_id == project_id)
    )
    return list(result.scalars().all())
@@ -1,418 +0,0 @@
 """High-level tool instance lifecycle orchestration.
 Coordinates Docker compose, container, tunnel, and config staging services
 to create, start, stop, restart, and delete tool instances.
 """
 import logging
 import os
 import shutil
 from datetime import datetime
 from typing import Any
 from fastapi import HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 from src.models.config_profile import ConfigProfile
 from src.models.git_repository import GitRepository
 from src.models.project import Project
 from src.models.tool_instance import ToolInstance
 from src.models.tool_type import ToolType
 from src.models.user import User
 from src.services.docker import compose as compose_svc
 from src.services.docker import config_staging
 from src.services.docker import container as container_svc
 from src.services.docker import tunnel as tunnel_svc
 from src.services.docker_build import build_image
 from src.services.readiness_probe import execute_probe
 logger = logging.getLogger(__name__)
 async def create_new_instance(
    session: AsyncSession,
    project: Project,
    repo: GitRepository,
    tool_type: ToolType,
    user: User,
    display_name: str | None,
    selected_profile: ConfigProfile | None,
 ) -> ToolInstance:
    """Create a new tool instance record and its compose file."""
    instance_name = await compose_svc._generate_instance_name(
        session, project.name, tool_type.name
    )
    instance_dir = compose_svc.ensure_instance_directory(instance_name)
    tool_port = container_svc.find_free_port()
    compose_path = await _build_or_render_compose(
        tool_type, instance_name, instance_dir, repo, user, project.id, tool_port
    )
    instance = ToolInstance(
        name=instance_name,
        display_name=display_name
        or f"{project.name} / {repo.name} / {tool_type.display_name}",
        tool_type_id=tool_type.id,
        repository_id=repo.id,
        project_id=project.id,
        owner_id=user.id,
        status="pending",
        compose_path=compose_path,
        port=tool_port,
        selected_profile_id=selected_profile.id if selected_profile else None,
    )
    session.add(instance)
    await session.commit()
    await session.refresh(instance)
    return instance
 async def start_existing_instance(
    session: AsyncSession,
    instance: ToolInstance,
    user: User,
    project_id: Any,
 ) -> dict:
    """Start an existing instance: stage configs, compose up, probe, tunnel."""
    if not instance.compose_path or not os.path.exists(instance.compose_path):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST, detail="compose file not found"
        )
    instance.status = "building"
    await session.commit()
    env_vars: dict[str, str] = {}
    config_files: dict[str, str] = {}
    port_override = None
    start_command = None
    working_directory = None
    extra_volumes: list[dict] = []
    selected_profile = None
    if instance.selected_profile_id:
        selected_profile = await session.get(
            ConfigProfile, instance.selected_profile_id
        )
        if selected_profile and selected_profile.user_id == user.id:
            instance_dir = os.path.dirname(instance.compose_path)
            (
                env_vars,
                port_override,
                start_command,
                working_directory,
                extra_volumes,
            ) = await compose_svc._apply_resolved_profile(
                selected_profile,
                instance_dir,
                env_vars,
                port_override,
                start_command,
                working_directory,
                extra_volumes,
            )
    env_file_path, extra_volumes = await _stage_configs(
        os.path.dirname(instance.compose_path), env_vars, config_files, extra_volumes
    )
    if port_override or start_command or working_directory or extra_volumes:
        compose_svc._modify_compose_file(
            instance.compose_path,
            port_override,
            start_command,
            working_directory,
            extra_volumes,
        )
    returncode, _stdout, stderr = compose_svc.execute_compose_command(
        instance.compose_path, "up", env_file=env_file_path
    )
    if returncode != 0:
        instance.status = "error"
        await session.commit()
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"failed to start instance: {stderr}",
        )
    container_id = container_svc.get_container_id(instance.name)
    if container_id:
        instance.container_id = container_id
    container_name = container_svc.get_container_name(instance.name)
    if container_name:
        instance.container_name = container_name
        container_svc.connect_container_to_network(container_name, "backend")
    instance.status = "starting"
    instance.last_started_at = datetime.now()
    await session.commit()
    tool_type = await session.get(ToolType, instance.tool_type_id)
    if not tool_type:
        instance.status = "error"
        await session.commit()
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="tool type not found for instance",
        )
    success, probe_logs = await _run_readiness_probe(instance, tool_type)
    if not success:
        instance.status = "failed"
        instance.url = None
        instance.public_url = None
        await session.commit()
        return {
            "status": "failed",
            "error": f"Readiness probe failed: {' '.join(probe_logs)}",
        }
    instance.status = "running"
    await session.commit()
    await _start_tunnel_if_web(instance, tool_type)
    await session.commit()
    return {"status": instance.status, "url": instance.url}
 async def restart_existing_instance(
    session: AsyncSession,
    instance: ToolInstance,
    user: User,
    project_id: Any,
 ) -> dict:
    """Restart an instance: re-stage configs, compose restart, tunnel."""
    if instance.tunnel_id:
        try:
            tunnel_svc.stop_cloudflared_tunnel(instance.tunnel_id)
        except Exception as exc:
            logger.warning("Failed to stop old tunnel: %s", exc)
    if not instance.compose_path or not os.path.exists(instance.compose_path):
        instance.status = "error"
        await session.commit()
        return {"status": instance.status}
    env_vars: dict[str, str] = {}
    config_files: dict[str, str] = {}
    port_override = None
    start_command = None
    working_directory = None
    extra_volumes: list[dict] = []
    stored_profile = None
    if instance.selected_profile_id:
        stored_profile = await session.get(ConfigProfile, instance.selected_profile_id)
        if stored_profile and stored_profile.user_id == user.id:
            instance_dir = os.path.dirname(instance.compose_path)
            (
                env_vars,
                port_override,
                start_command,
                working_directory,
                extra_volumes,
            ) = await compose_svc._apply_resolved_profile(
                stored_profile,
                instance_dir,
                env_vars,
                port_override,
                start_command,
                working_directory,
                extra_volumes,
            )
    env_file_path, extra_volumes = await _stage_configs(
        os.path.dirname(instance.compose_path), env_vars, config_files, extra_volumes
    )
    if port_override or start_command or working_directory or extra_volumes:
        compose_svc._modify_compose_file(
            instance.compose_path,
            port_override,
            start_command,
            working_directory,
            extra_volumes,
        )
    returncode, _stdout, _stderr = compose_svc.execute_compose_command(
        instance.compose_path, "restart", env_file=env_file_path
    )
    if returncode != 0:
        instance.status = "error"
        await session.commit()
        return {"status": instance.status}
    instance.status = "running"
    instance.last_started_at = datetime.now()
    tool_type = await session.get(ToolType, instance.tool_type_id)
    if not tool_type:
        instance.status = "error"
        await session.commit()
        return {"status": instance.status}
    await _start_tunnel_if_web(instance, tool_type)
    await session.commit()
    return {"status": instance.status, "url": instance.url}
 async def stop_existing_instance(session: AsyncSession, instance: ToolInstance) -> None:
    """Stop an instance and its tunnel."""
    if instance.tunnel_id:
        try:
            tunnel_svc.stop_cloudflared_tunnel(instance.tunnel_id)
        except Exception as exc:
            logger.warning("Failed to stop tunnel: %s", exc)
    if instance.compose_path and os.path.exists(instance.compose_path):
        compose_svc.execute_compose_command(instance.compose_path, "stop")
    instance.status = "stopped"
    instance.last_stopped_at = datetime.now()
    instance.url = None
    instance.public_url = None
    instance.tunnel_id = None
    await session.commit()
 async def delete_existing_instance(
    session: AsyncSession, instance: ToolInstance
 ) -> None:
    """Delete an instance, its containers, and its directory."""
    if instance.tunnel_id:
        try:
            tunnel_svc.stop_cloudflared_tunnel(instance.tunnel_id)
        except Exception as exc:
            logger.warning("Failed to stop tunnel: %s", exc)
    if instance.compose_path and os.path.exists(instance.compose_path):
        compose_svc.execute_compose_command(instance.compose_path, "down")
        instance_dir = os.path.dirname(instance.compose_path)
        if os.path.exists(instance_dir):
            shutil.rmtree(instance_dir)
    await session.delete(instance)
    await session.commit()
 # ── Internal helpers ───────────────────────────────────────────────────────
 async def _build_or_render_compose(
    tool_type: ToolType,
    instance_name: str,
    instance_dir: str,
    repo: GitRepository,
    user: User,
    project_id: Any,
    tool_port: int,
 ) -> str:
    """Build Dockerfile or render compose template."""
    if tool_type.definition_type == "dockerfile":
        image_tag = f"headquarter/{instance_name}:latest"
        if tool_type.dockerfile_template:
            returncode, _stdout, stderr = build_image(
                instance_dir=instance_dir,
                dockerfile=tool_type.dockerfile_template,
                tag=image_tag,
                build_context=tool_type.build_context,
            )
            if returncode != 0:
                logger.error("Build failed for %s: %s", instance_name, stderr)
                raise HTTPException(
                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                    detail=f"Failed to build Docker image: {stderr[:500]}",
                )
        compose_content = (
            f'version: "3.8"\nservices:\n  app:\n'
            f"    image: {image_tag}\n"
            f"    container_name: {instance_name}\n"
            f'    ports:\n      - "{tool_port}:{tool_type.default_port}"\n'
            f"    volumes:\n      - {repo.path}:/workspace\n"
            f"    restart: unless-stopped\n"
        )
    else:
        variables = {
            "REPO_PATH": repo.path,
            "INSTANCE_NAME": instance_name,
            "INSTANCE_ID": instance_name,
            "TOOL_NAME": instance_name,
            "TOOL_PORT": tool_port,
            "USER_ID": str(user.id),
            "PROJECT_ID": str(project_id),
        }
        if not tool_type.compose_template:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail="tool type has no compose template",
            )
        compose_content = compose_svc.render_compose_template(
            tool_type.compose_template, variables
        )
    compose_svc.write_compose_file(instance_dir, compose_content)
    return os.path.join(instance_dir, "docker-compose.yml")
 async def _stage_configs(
    instance_dir: str,
    env_vars: dict[str, str],
    config_files: dict[str, str],
    extra_volumes: list[dict],
 ) -> tuple[str | None, list[dict]]:
    """Write env/config files for the resolved profile."""
    env_file_path: str | None = None
    if env_vars:
        env_file_path = compose_svc.write_env_file(instance_dir, env_vars)
    if config_files:
        config_staging.write_config_files(instance_dir, config_files)
    return env_file_path, extra_volumes
 async def _start_tunnel_if_web(instance: ToolInstance, tool_type: ToolType) -> None:
    """Create Cloudflare tunnel for web-enabled tools."""
    if tool_type.interface_type != "web" or not tool_type.default_port:
        instance.url = None
        instance.public_url = None
        return
    try:
        tunnel_info = tunnel_svc.start_cloudflared_tunnel(
            container_name=instance.container_name or instance.name,
            port=tool_type.default_port,
        )
        instance.tunnel_id = tunnel_info["pid"]
        instance.public_url = tunnel_info["url"]
        instance.url = tunnel_info["url"]
        logger.info(
            "Created tunnel for instance %s: %s", instance.id, tunnel_info["url"]
        )
    except Exception as exc:
        logger.error("Failed to create tunnel for instance %s: %s", instance.id, exc)
        instance.status = "error"
        instance.url = None
 async def _run_readiness_probe(
    instance: ToolInstance, tool_type: ToolType
 ) -> tuple[bool, list[str]]:
    """Run readiness probe if configured."""
    if not tool_type.readiness_probe or not instance.container_id:
        return True, []
    probe = tool_type.readiness_probe
    command = probe.get("command", "")
    if not command:
        return True, []
    return await execute_probe(
        container_id=instance.container_id,
        command=command,
        timeout=probe.get("timeout", 30),
        interval=probe.get("interval", 2),
    )
@@ -1,251 +0,0 @@
 """Profile resolver service for recursive ordered include resolution.
 Provides deterministic merge rules, save-independent cycle protection,
 and resolved output structures for env vars, runtime hints, mounts,
 file trees, and override metadata.
 """
 from __future__ import annotations
 import uuid
 from dataclasses import dataclass, field
 from src.models.config_include import ConfigInclude
 from src.models.config_mount import ConfigMount
 from src.models.config_profile import ConfigProfile
@dataclass
 class ResolvedMount:
    """A resolved mount with merged file tree and final mode."""
    target_path: str
    mode: str  # "ro" or "rw"
    files: dict[str, str] = field(default_factory=dict)
    """Relative file paths to UTF-8 text content."""
    overridden_files: dict[str, list[str]] = field(default_factory=dict)
    """Map of relative file path to list of profile names that contributed
    (latest is the winner)."""
    mode_overridden_by: str | None = None
    """Name of the profile that set the final mode, if different from first."""
@dataclass
 class ResolvedRuntimeHints:
    """Resolved runtime hints from profile layers."""
    start_command: str | None = None
    working_directory: str | None = None
    port: int | None = None
    overridden_hints: dict[str, str] = field(default_factory=dict)
    """Map of hint key to profile name that provided the winning value."""
@dataclass
 class ResolvedProfileOutput:
    """Complete resolved output for a config profile."""
    profile_id: uuid.UUID
    profile_name: str
    environment_variables: dict[str, str] = field(default_factory=dict)
    """Final merged env vars (later layers win)."""
    env_var_sources: dict[str, list[str]] = field(default_factory=dict)
    """Map of env var key to ordered list of contributing profile names
    (latest is the winner)."""
    runtime_hints: ResolvedRuntimeHints = field(
        default_factory=lambda: ResolvedRuntimeHints()
    )
    mounts: dict[str, ResolvedMount] = field(default_factory=dict)
    """Map of target_path to ResolvedMount."""
    resolution_order: list[str] = field(default_factory=list)
    """Ordered list of profile names as they were resolved."""
    cycle_detected: bool = False
    cycle_path: list[str] | None = None
 class ProfileResolutionError(Exception):
    """Raised when profile resolution fails."""
    pass
 class ProfileCycleError(ProfileResolutionError):
    """Raised when a cycle is detected during profile resolution."""
    def __init__(self, cycle_path: list[str]) -> None:
        self.cycle_path = cycle_path
        path_str = " -> ".join(cycle_path)
        super().__init__(f"Profile include cycle detected: {path_str}")
 def _merge_env_vars(
    current: dict[str, str],
    sources: dict[str, list[str]],
    profile: ConfigProfile,
 ) -> None:
    """Merge a profile's env vars into the current dict, tracking sources."""
    if not profile.environment_variables:
        return
    for key, value in profile.environment_variables.items():
        current[key] = value
        if key not in sources:
            sources[key] = []
        sources[key].append(profile.name)
 def _merge_runtime_hints(
    hints: ResolvedRuntimeHints,
    profile: ConfigProfile,
 ) -> None:
    """Merge a profile's runtime hints, tracking overrides."""
    if profile.start_command is not None:
        hints.start_command = profile.start_command
        hints.overridden_hints["start_command"] = profile.name
    if profile.working_directory is not None:
        hints.working_directory = profile.working_directory
        hints.overridden_hints["working_directory"] = profile.name
    if profile.port is not None:
        hints.port = profile.port
        hints.overridden_hints["port"] = profile.name
 def _merge_mounts(
    mounts: dict[str, ResolvedMount],
    profile_mounts: list[ConfigMount],
    profile: ConfigProfile,
 ) -> None:
    """Merge a profile's mounts into the current mounts dict."""
    for mount in profile_mounts:
        target = mount.target_path
        if target not in mounts:
            mounts[target] = ResolvedMount(
                target_path=target,
                mode=mount.mode,
                files={},
                overridden_files={},
            )
        resolved = mounts[target]
        # Mode override: later wins
        if resolved.mode != mount.mode:
            resolved.mode = mount.mode
            resolved.mode_overridden_by = profile.name
        # File tree merge: later wins for same relative path
        if mount.files:
            for rel_path, content in mount.files.items():
                if rel_path not in resolved.files:
                    resolved.overridden_files[rel_path] = []
                else:
                    if rel_path not in resolved.overridden_files:
                        resolved.overridden_files[rel_path] = []
                    resolved.overridden_files[rel_path].append(profile.name)
                resolved.files[rel_path] = content
 def _resolve_profile_recursive(
    profile: ConfigProfile,
    visited: set[uuid.UUID],
    path: list[str],
    resolution_order: list[str],
    env_vars: dict[str, str],
    env_var_sources: dict[str, list[str]],
    runtime_hints: ResolvedRuntimeHints,
    mounts: dict[str, ResolvedMount],
 ) -> None:
    """Recursively resolve a profile and its includes.
    Args:
        profile: The profile to resolve
        visited: Set of already-resolved profile IDs to avoid duplicates
        path: Current recursion path for cycle detection
        resolution_order: Ordered list of profile names being resolved
        env_vars: Accumulated environment variables
        env_var_sources: Tracking of which profiles contributed each env var
        runtime_hints: Accumulated runtime hints
        mounts: Accumulated mounts
    Raises:
        ProfileCycleError: If a cycle is detected
    """
    if profile.name in path:
        # Cycle detected
        cycle_start = path.index(profile.name)
        cycle_path = path[cycle_start:] + [profile.name]
        raise ProfileCycleError(cycle_path)
    if profile.id in visited:
        # Already resolved in another branch (diamond graph)
        return
    visited.add(profile.id)
    path.append(profile.name)
    resolution_order.append(profile.name)
    # Resolve includes first (in order)
    includes: list[ConfigInclude] = list(profile.includes)
    includes.sort(key=lambda inc: inc.order_index)
    for include in includes:
        included_profile = include.included_profile
        if included_profile is not None:
            _resolve_profile_recursive(
                included_profile,
                visited,
                path,
                resolution_order,
                env_vars,
                env_var_sources,
                runtime_hints,
                mounts,
            )
    # Apply this profile's values (later layers win)
    _merge_env_vars(env_vars, env_var_sources, profile)
    _merge_runtime_hints(runtime_hints, profile)
    _merge_mounts(mounts, list(profile.mounts), profile)
    path.pop()
 def resolve_profile(profile: ConfigProfile) -> ResolvedProfileOutput:
    """Resolve a config profile with all its includes.
    Processes included profiles in configured order, then applies the
    selected profile itself. Later layers override earlier layers.
    Args:
        profile: The root profile to resolve
    Returns:
        ResolvedProfileOutput with merged env vars, runtime hints, mounts,
        and override metadata
    Raises:
        ProfileCycleError: If a cycle is detected in the include graph
    """
    env_vars: dict[str, str] = {}
    env_var_sources: dict[str, list[str]] = {}
    runtime_hints = ResolvedRuntimeHints()
    mounts: dict[str, ResolvedMount] = {}
    resolution_order: list[str] = []
    _resolve_profile_recursive(
        profile,
        set(),
        [],
        resolution_order,
        env_vars,
        env_var_sources,
        runtime_hints,
        mounts,
    )
    return ResolvedProfileOutput(
        profile_id=profile.id,
        profile_name=profile.name,
        environment_variables=env_vars,
        env_var_sources=env_var_sources,
        runtime_hints=runtime_hints,
        mounts=mounts,
        resolution_order=resolution_order,
    )
@@ -1,193 +1,426 @@
 """Terminal session manager for WebSocket connections."""
 import asyncio
 import contextlib
 import json
 import logging
 import time
 import uuid
-from collections.abc import Coroutine
+from datetime import datetime, timezone
 from typing import Any
 from fastapi import WebSocket
 from sqlalchemy.dialects.postgresql import insert as pg_insert
 from src.database import SessionLocal
 from src.models.terminal_session import TerminalSessionModel
 from src.services.terminal_session import TerminalSession
 logger = logging.getLogger(__name__)
-_READ_BATCH_INTERVAL_S = 0.016  # 16ms max batching delay
+
-_READ_POLL_TIMEOUT_S = 0.005
+class MaxSessionsExceededError(Exception):
-_READ_POLL_SLEEP_S = 0.001
+    """Raised when the maximum number of terminal sessions per instance is reached."""
-_HEARTBEAT_INTERVAL_S = 15.0
+
-_IDLE_TIMEOUT_S = 60.0
+    def __init__(self, instance_id: str, max_sessions: int = 5) -> None:
        self.instance_id = instance_id
        self.max_sessions = max_sessions
        super().__init__(
            f"Maximum of {max_sessions} terminal sessions reached for instance {instance_id}"
        )
 class TerminalManager:
-    """Manages active terminal sessions."""
+    """Manages active terminal sessions with persistence support."""
    # Maximum sessions per tool instance
    MAX_SESSIONS_PER_INSTANCE = 5
    def __init__(self) -> None:
-        """Initialise the terminal manager."""
+        # Track sessions by (instance_id, session_id) for multi-session support
-        self._sessions: dict[str, TerminalSession] = {}
+        self._sessions: dict[tuple[str, str], TerminalSession] = {}
-        self._last_client_message: dict[str, float] = {}
+        self._idle_check_task: asyncio.Task | None = None
-        self._background_tasks: set[asyncio.Task[Any]] = set()
+        self._start_idle_check()
    def _start_idle_check(self) -> None:
        """Start the idle timeout background task."""
        if self._idle_check_task is not None and not self._idle_check_task.done():
            return
        try:
            loop = asyncio.get_running_loop()
            self._idle_check_task = loop.create_task(self._idle_check_loop())
        except RuntimeError:
            # No event loop running yet, will be started lazily
            pass
    async def _idle_check_loop(self) -> None:
        """Periodically check for idle sessions and clean them up."""
        while True:
            try:
                await asyncio.sleep(60)  # Check every minute
                await self._cleanup_idle_sessions()
            except Exception as exc:
                logger.error("Error in idle check loop: %s", exc)
    async def _cleanup_idle_sessions(self) -> None:
        """Clean up sessions that have been idle for too long."""
        idle_keys = []
        for (instance_id, session_id), session in list(self._sessions.items()):
            if session.is_idle():
                idle_keys.append((instance_id, session_id))
        for key in idle_keys:
            instance_id, session_id = key
            logger.info(
                "Cleaning up idle terminal session %s for instance %s",
                session_id,
                instance_id,
            )
            session = self._sessions.pop(key, None)
            if session:
                await session.close()
                # Update DB status fire-and-forget
                asyncio.create_task(self._mark_closed_in_db(session_id))
    async def _insert_db_session_row(
        self,
        session_id: str,
        instance_id: uuid.UUID,
        name: str,
    ) -> None:
        """Insert a TerminalSessionModel row into the database.
        Uses ON CONFLICT DO NOTHING to handle races when a session is
        restored from DB and then re-inserted.
        """
        try:
            async with SessionLocal() as db_session:
                stmt = (
                    pg_insert(TerminalSessionModel)
                    .values(
                        id=uuid.UUID(session_id),
                        instance_id=instance_id,
                        name=name,
                        status="active",
                        created_at=datetime.now(timezone.utc),
                        last_activity_at=datetime.now(timezone.utc),
                    )
                    .on_conflict_do_nothing(index_elements=["id"])
                )
                await db_session.execute(stmt)
                await db_session.commit()
                logger.debug(
                    "Inserted terminal session row %s for instance %s",
                    session_id,
                    instance_id,
                )
        except Exception as exc:
            logger.error("Failed to insert terminal session row: %s", exc)
    async def _mark_closed_in_db(self, session_id: str) -> None:
        """Mark a terminal session as closed in the database."""
        try:
            async with SessionLocal() as db_session:
                db_row = await db_session.get(
                    TerminalSessionModel, uuid.UUID(session_id)
                )
                if db_row:
                    db_row.status = "closed"
                    db_row.closed_at = datetime.now(timezone.utc)
                    await db_session.commit()
                    logger.debug(
                        "Marked terminal session %s as closed in DB", session_id
                    )
        except Exception as exc:
            logger.error("Failed to mark terminal session as closed in DB: %s", exc)
    def _count_sessions_for_instance(self, instance_id_str: str) -> int:
        """Count active in-memory sessions for a given instance."""
        return sum(1 for (iid, _sid) in self._sessions if iid == instance_id_str)
    async def create_session(
        self,
        instance_id: uuid.UUID,
        container_id: str,
-        websocket: WebSocket,
+        startup_command: str | None = None,
        name: str | None = None,
        session_id: str | None = None,
    ) -> TerminalSession:
-        """Create a new terminal session."""
+        """Create a new terminal session for an instance.
        session_id = str(uuid.uuid4())
        session = TerminalSession(session_id, instance_id, container_id)
        await session.start()
        self._sessions[session_id] = session
        self._last_client_message[session_id] = time.monotonic()
-        # Start background tasks for I/O streaming
+        Enforces a maximum of MAX_SESSIONS_PER_INSTANCE sessions per instance.
-        self._start_task(self._read_loop(session, websocket))
+        Inserts a DB row fire-and-forget.
-        self._start_task(self._write_loop(session, websocket))
+
-        self._start_task(self._heartbeat_loop(session, websocket))
+        Args:
            instance_id: UUID of the tool instance.
            container_id: Docker container ID.
            startup_command: Optional startup command to run.
            name: Optional session name (auto-generated if omitted).
        Returns:
            The newly created TerminalSession.
        Raises:
            MaxSessionsExceededError: If the instance already has max sessions.
        """
        instance_id_str = str(instance_id)
        if (
            self._count_sessions_for_instance(instance_id_str)
            >= self.MAX_SESSIONS_PER_INSTANCE
        ):
            raise MaxSessionsExceededError(
                instance_id_str, self.MAX_SESSIONS_PER_INSTANCE
            )
        if session_id is None:
            session_id = str(uuid.uuid4())
        session = TerminalSession(
            session_id=session_id,
            instance_id=instance_id,
            container_id=container_id,
            startup_command=startup_command,
            name=name,
        )
        await session.start(startup_command=startup_command)
        key = (instance_id_str, session_id)
        self._sessions[key] = session
        # Fire-and-forget DB insert (skip if row already exists)
        asyncio.create_task(
            self._insert_db_session_row(session_id, instance_id, session.name)
        )
        logger.info(
            "Created terminal session %s for instance %s (name=%s)",
            session_id,
            instance_id,
            session.name,
        )
        return session
    async def get_or_create_session(
        self,
        instance_id: uuid.UUID,
        container_id: str,
        startup_command: str | None = None,
    ) -> TerminalSession:
        """Get existing session or create a new one.
        Backward-compatible alias that uses 'default' as the session_id.
        """
        # Ensure idle check is running (lazy start)
        self._start_idle_check()
        instance_id_str = str(instance_id)
        key = (instance_id_str, "default")
        # Check for existing default session
        if key in self._sessions:
            session = self._sessions[key]
            # Check if session is still alive
            if session.is_alive():
                logger.debug(
                    "Reattaching to existing terminal session for instance %s",
                    instance_id,
                )
                return session
            else:
                # Session died, clean it up
                logger.debug(
                    "Existing session for instance %s is dead, cleaning up",
                    instance_id,
                )
                await session.close()
                del self._sessions[key]
        # Create new default session
        logger.info(
            "Creating new default terminal session for instance %s", instance_id
        )
        session_id = str(uuid.uuid4())
        session = TerminalSession(
            session_id=session_id,
            instance_id=instance_id,
            container_id=container_id,
            startup_command=startup_command,
            name="Session 1",
        )
        await session.start(startup_command=startup_command)
        self._sessions[key] = session
        # Fire-and-forget DB insert
        asyncio.create_task(
            self._insert_db_session_row(session_id, instance_id, session.name)
        )
        return session
-    def _start_task(self, coro: Coroutine[Any, Any, None]) -> None:
+    def get_session(
        """Start a background task and store a reference to prevent GC."""
        task = asyncio.create_task(coro)
        self._background_tasks.add(task)
        task.add_done_callback(self._background_tasks.discard)
    async def _read_loop(
        self,
-        session: TerminalSession,
+        instance_id: str,
-        websocket: WebSocket,
+        session_id: str,
-    ) -> None:
+    ) -> TerminalSession | None:
-        """Read output from the container and send to WebSocket with batching."""
+        """Lookup a session by composite key, or by internal session_id."""
-        try:
+        session = self._sessions.get((instance_id, session_id))
-            buffer = bytearray()
+        if session is not None:
-            last_flush = time.monotonic()
+            return session
        # Fallback: search by internal TerminalSession.session_id
        for (iid, _sid), sess in self._sessions.items():
            if iid == instance_id and sess.session_id == session_id:
                return sess
        return None
-            while session.is_alive() and not session.closed:
+    def _find_key_by_internal_id(
                data = await session.read_output(select_timeout=_READ_POLL_TIMEOUT_S)
                if data:
                    buffer.extend(data)
                now = time.monotonic()
                flush_due = buffer and (
                    now - last_flush >= _READ_BATCH_INTERVAL_S or not data
                )
                if flush_due:
                    await websocket.send_bytes(bytes(buffer))
                    buffer.clear()
                    last_flush = now
                elif not data:
                    await asyncio.sleep(_READ_POLL_SLEEP_S)
            # Flush any remaining data
            if buffer:
                with contextlib.suppress(Exception):
                    await websocket.send_bytes(bytes(buffer))
        except Exception:
            logger.exception("Read loop error for session %s", session.session_id)
        finally:
            await self._cleanup_session(session)
    async def _write_loop(
        self,
-        session: TerminalSession,
+        instance_id: str,
-        websocket: WebSocket,
+        internal_session_id: str,
-    ) -> None:
+    ) -> tuple[str, str] | None:
-        """Read input from WebSocket and send to container."""
+        """Find the manager dict key for a session by its internal session_id."""
-        try:
+        for (iid, sid), session in self._sessions.items():
-            while session.is_alive() and not session.closed:
+            if iid == instance_id and session.session_id == internal_session_id:
-                message = await websocket.receive()
+                return (iid, sid)
-                self._last_client_message[session.session_id] = time.monotonic()
+        return None
-                if message["type"] == "websocket.receive":
+    def get_sessions_for_instance(
                    if "bytes" in message:
                        await session.write_input(message["bytes"])
                    elif "text" in message:
                        text = message["text"]
                        if text.startswith("{"):
                            try:
                                ctrl = json.loads(text)
                                await self._handle_control_message(
                                    session,
                                    websocket,
                                    ctrl,
                                )
                            except json.JSONDecodeError:
                                logger.debug("Invalid JSON control message: %s", text)
                        else:
                            await session.write_input(text.encode("utf-8"))
                elif message["type"] == "websocket.disconnect":
                    break
        except Exception:
            logger.exception("Write loop error for session %s", session.session_id)
        finally:
            await self._cleanup_session(session)
    async def _handle_control_message(
        self,
-        session: TerminalSession,
+        instance_id: str,
-        websocket: WebSocket,
+    ) -> list[TerminalSession]:
-        ctrl: dict[str, Any],
+        """Return all in-memory sessions for a given instance."""
-    ) -> None:
+        return [
-        """Handle a JSON control message from the client."""
+            session
-        msg_type = ctrl.get("type")
+            for (iid, _sid), session in self._sessions.items()
-        if msg_type == "resize":
+            if iid == instance_id
-            await session.resize(
+        ]
                ctrl.get("cols", 80),
                ctrl.get("rows", 24),
            )
        elif msg_type == "ping":
            await websocket.send_json(
                {"type": "pong", "id": ctrl.get("id")},
            )
-    async def _heartbeat_loop(
+    async def close_session(
        self,
-        session: TerminalSession,
+        instance_id: str,
-        websocket: WebSocket,
+        session_id: str,
    ) -> None:
-        """Monitor client activity and close idle connections."""
+        """Close a specific session and update its DB status."""
-        try:
+        key = (instance_id, session_id)
-            while session.is_alive() and not session.closed:
+        session = self._sessions.pop(key, None)
-                await asyncio.sleep(_HEARTBEAT_INTERVAL_S)
+        if session:
                last_msg = self._last_client_message.get(session.session_id, 0)
                if time.monotonic() - last_msg > _IDLE_TIMEOUT_S:
                    # Client has been silent for 60s — close connection
                    with contextlib.suppress(Exception):
                        await websocket.close(
                            code=1000,
                            reason="Idle timeout",
                        )
                    break
        except Exception:
            logger.exception(
                "Heartbeat loop error for session %s",
                session.session_id,
            )
        finally:
            await self._cleanup_session(session)
    async def _cleanup_session(self, session: TerminalSession) -> None:
        """Clean up a session."""
        if session.session_id in self._sessions:
            del self._sessions[session.session_id]
        self._last_client_message.pop(session.session_id, None)
            await session.close()
            # Fire-and-forget DB update
            asyncio.create_task(self._mark_closed_in_db(session_id))
            logger.info(
                "Closed terminal session %s for instance %s",
                session_id,
                instance_id,
            )
    async def attach_websocket(
        self,
        session: TerminalSession,
        websocket: WebSocket,
    ) -> None:
        """Attach a WebSocket to an existing session.
        Closes existing WebSocket connections only for this specific session.
        """
        # Handle concurrent connections - close existing ones within the same session
        if session.has_websockets():
            logger.debug(
                "Closing existing WebSocket connections for session %s (instance %s)",
                session.session_id,
                session.instance_id,
            )
            for ws in list(session._websockets):
                try:
                    await ws.close(code=4000, reason="New connection established")
                except Exception:
                    pass  # noqa: S110
            session._websockets.clear()
        # Attach new WebSocket
        session.attach_websocket(websocket)
        # Replay buffer
        buffer = session.get_buffer()
        if buffer:
            try:
                await websocket.send_bytes(buffer)
            except Exception:
                pass  # noqa: S110
    async def detach_websocket(
        self,
        session: TerminalSession,
        websocket: WebSocket,
    ) -> None:
        """Detach a WebSocket from a session."""
        session.detach_websocket(websocket)
    async def reset_session(
        self,
        instance_id: uuid.UUID,
        container_id: str,
        startup_command: str | None = None,
        session_id: str | None = None,
        name: str | None = None,
    ) -> TerminalSession:
        """Reset a session by killing it and creating a new one.
        Args:
            instance_id: UUID of the tool instance.
            container_id: Docker container ID.
            startup_command: Optional startup command.
            session_id: Specific session to reset. If None, resets the default session.
            name: Optional name to preserve for the new session.
        Returns:
            The newly created TerminalSession.
        """
        instance_id_str = str(instance_id)
        target_session_id = session_id or "default"
        key = (instance_id_str, target_session_id)
        # Preserve old name if not provided
        old_name = name
        if old_name is None and key in self._sessions:
            old_name = self._sessions[key].name
        # Close existing session if any
        if key in self._sessions:
            logger.debug(
                "Resetting terminal session %s for instance %s",
                target_session_id,
                instance_id,
            )
            old_session = self._sessions.pop(key)
            await old_session.close()
            # Fire-and-forget DB update for old session
            asyncio.create_task(self._mark_closed_in_db(old_session.session_id))
        # Create new session preserving the same session_id slot
        new_session_id = str(uuid.uuid4())
        new_session = TerminalSession(
            session_id=new_session_id,
            instance_id=instance_id,
            container_id=container_id,
            startup_command=startup_command,
            name=old_name or ("Session 1" if target_session_id == "default" else None),
        )
        await new_session.start(startup_command=startup_command)
        self._sessions[key] = new_session
        # Fire-and-forget DB insert
        asyncio.create_task(
            self._insert_db_session_row(new_session_id, instance_id, new_session.name)
        )
        return new_session
    async def close_all(self) -> None:
        """Close all active sessions."""
        sessions = list(self._sessions.values())
        self._sessions.clear()
        self._last_client_message.clear()
        for session in sessions:
            await session.close()
        if self._idle_check_task and not self._idle_check_task.done():
            self._idle_check_task.cancel()
 # Global terminal manager instance
 terminal_manager = TerminalManager()
@@ -1,44 +1,136 @@
-"""Terminal session management for tool instances."""
+"""High-performance terminal session with asyncio-native I/O.
 Replaces blocking select.select() with event-driven asyncio.add_reader()
 for sub-frame latency. Includes output batching and flow control.
 """
 import asyncio
 import contextlib
 import fcntl
 import logging
 import os
 import pty
-import select
+import signal
 import struct
-import termios
+import fcntl
 import time
 import uuid
 from collections import deque
 from typing import Any
 logger = logging.getLogger(__name__)
 class TerminalSession:
-    """Manages a single terminal session connected to a docker container."""
+    """Manages a single terminal session with event-driven PTY I/O.
    Uses asyncio.add_reader() instead of polling for near-zero read latency.
    Output is batched (2ms window) and sent as binary WebSocket frames.
    Flow control prevents memory bloat on fast output.
    """
    # Circular buffer for replay (10KB)
    BUFFER_SIZE = 10 * 1024
    # Idle timeout in seconds (30 minutes)
    IDLE_TIMEOUT = 30 * 60
    # Output batching window in seconds
    BATCH_WINDOW_S = 0.002  # 2ms
    # Flow control: pause PTY reads when unacknowledged bytes exceed this
    FLOW_CONTROL_PAUSE = 64 * 1024
    # Flow control: resume PTY reads when unacknowledged bytes drop below this
    FLOW_CONTROL_RESUME = 32 * 1024
    # Max WebSocket frame size
    MAX_FRAME_SIZE = 64 * 1024
    # Session number counter per instance_id for auto-naming
    _instance_counters: dict[str, int] = {}
    def __init__(
        self,
        session_id: str,
        instance_id: uuid.UUID,
        container_id: str,
        startup_command: str | None = None,
        name: str | None = None,
    ) -> None:
        """Initialize a terminal session."""
        self.session_id = session_id
        self.instance_id = instance_id
        self.container_id = container_id
        self.startup_command = startup_command
        self.process: asyncio.subprocess.Process | None = None
        self._closed = False
        self._master_fd: int | None = None
        self._slave_fd: int | None = None
        self._echo_enabled = True
        self._exit_reason: str | None = None
-    async def start(self) -> None:
+        # Circular buffer for output replay
        self._output_buffer: deque[bytes] = deque(maxlen=self.BUFFER_SIZE)
        self._buffer_size = 0
        # WebSocket connections
        self._websockets: set[Any] = set()
        # Activity tracking
        self.last_activity = time.time()
        # Terminal size
        self._cols = 80
        self._rows = 24
        # Session metadata
        self.name = name or self._generate_name(str(instance_id))
        self.status: str = "active"
        # Output batching
        self._batch_buffer = bytearray()
        self._batch_timer: asyncio.TimerHandle | None = None
        self._batch_lock = asyncio.Lock()
        # Flow control
        self._unacknowledged_bytes = 0
        self._paused = False
        self._read_handler_set = False
        self._flow_control_lock = asyncio.Lock()
        # Ack timeout fallback
        self._ack_timeout_handle: asyncio.TimerHandle | None = None
    @classmethod
    def _generate_name(cls, instance_id: str) -> str:
        """Generate an auto-incremented session name for the instance."""
        count = cls._instance_counters.get(instance_id, 0) + 1
        cls._instance_counters[instance_id] = count
        return f"Session {count}"
    async def start(self, startup_command: str | None = None) -> None:
        """Start the docker exec process with a shell using a PTY."""
-        self._master_fd, self._slave_fd = pty.openpty()
+        # Create a pseudo-terminal on the host
-        self._set_terminal_size(80, 24)
+        self._master_fd, slave_fd = pty.openpty()
        # Set the terminal size initially
        self._set_terminal_size(self._cols, self._rows)
        logger.debug(
            "Starting terminal session %s for container %s with initial size %sx%s",
            self.session_id,
            self.container_id,
            self._cols,
            self._rows,
        )
        # Build the shell command
        cmd = startup_command or self.startup_command
        if cmd:
            shell_cmd = f'bash -c "{cmd}" || true; exec bash -il'
            logger.debug(
                "Using startup command for session %s: %s",
                self.session_id,
                cmd,
            )
        else:
            shell_cmd = "bash -il"
        # Start docker exec with the slave fd as stdin/stdout/stderr
        self.process = await asyncio.create_subprocess_exec(
            "docker",
            "exec",
@@ -47,112 +139,287 @@ class TerminalSession:
            "TERM=xterm-256color",
            self.container_id,
            "bash",
-            "-il",
+            "-c",
-            stdin=self._slave_fd,
+            shell_cmd,
-            stdout=self._slave_fd,
+            stdin=slave_fd,
-            stderr=self._slave_fd,
+            stdout=slave_fd,
            stderr=slave_fd,
        )
-        os.close(self._slave_fd)
+        # Close slave fd in parent process
-        self._slave_fd = None
+        os.close(slave_fd)
        self._echo_enabled = self._detect_echo_state()
-    def _set_terminal_size(self, cols: int, rows: int) -> None:
+        self.last_activity = time.time()
-        """Set the terminal size using TIOCSWINSZ."""
+
-        if self._master_fd is None:
+        # Start event-driven reading
        self._start_reading()
    def _start_reading(self) -> None:
        """Register PTY master fd with asyncio event loop for event-driven reads."""
        if self._read_handler_set or self._master_fd is None or self._closed:
            return
        tiocswinsz = 0x5414
        size = struct.pack("HHHH", rows, cols, 0, 0)
        with contextlib.suppress(OSError):
            fcntl.ioctl(self._master_fd, tiocswinsz, size)
    def _detect_echo_state(self) -> bool:
        """Detect whether the PTY has echo enabled via termios."""
        if self._master_fd is None:
            return True
        try:
-            attrs = termios.tcgetattr(self._master_fd)
+            loop = asyncio.get_event_loop()
-            return bool(attrs[3] & termios.ECHO)
+            loop.add_reader(self._master_fd, self._on_fd_readable)
-        except OSError:
+            self._read_handler_set = True
-            return True
+            logger.debug("Started event-driven reading for session %s", self.session_id)
-
+        except Exception as exc:
-    async def check_echo_state(self) -> bool | None:
+            logger.error(
-        """Check if echo state changed. Returns new state if changed, None otherwise."""
+                "Failed to start reading for session %s: %s", self.session_id, exc
        current = self._detect_echo_state()
        if current != self._echo_enabled:
            self._echo_enabled = current
            return current
        return None
    @property
    def echo_enabled(self) -> bool:
        """Return whether the PTY currently has echo enabled."""
        return self._echo_enabled
    @property
    def closed(self) -> bool:
        """Return whether the session has been closed."""
        return self._closed
    async def read_output(self, select_timeout: float = 0.1) -> bytes:
        """Read output from the PTY master."""
        if self._master_fd is None or self._closed:
            return b""
        try:
            readable, _, _ = select.select(
                [self._master_fd],
                [],
                [],
                select_timeout,
            )
-            if readable:
+
-                return os.read(self._master_fd, 8192)
+    def _stop_reading(self) -> None:
-            return b""
+        """Unregister PTY master fd from asyncio event loop."""
-        except (OSError, ValueError):
+        if not self._read_handler_set or self._master_fd is None:
-            return b""
+            return
        try:
            loop = asyncio.get_event_loop()
            loop.remove_reader(self._master_fd)
            self._read_handler_set = False
        except Exception:
            pass
    def _on_fd_readable(self) -> None:
        """Callback when PTY master fd has data available (called by event loop)."""
        if self._master_fd is None or self._closed:
            return
        try:
            data = os.read(self._master_fd, 4096)
        except (OSError, IOError) as exc:
            logger.debug("PTY read error for session %s: %s", self.session_id, exc)
            self._handle_eof()
            return
        if not data:
            # EOF: docker exec process exited
            logger.debug("PTY EOF for session %s", self.session_id)
            self._handle_eof()
            return
        self._add_to_buffer(data)
        self.last_activity = time.time()
        # Queue for batching + flow control
        self._queue_output(data)
    def _add_to_buffer(self, data: bytes) -> None:
        """Add data to circular buffer, maintaining size limit."""
        self._output_buffer.append(data)
        self._buffer_size += len(data)
        while self._buffer_size > self.BUFFER_SIZE and self._output_buffer:
            removed = self._output_buffer.popleft()
            self._buffer_size -= len(removed)
    def _queue_output(self, data: bytes) -> None:
        """Add output to batch buffer and schedule flush."""
        self._batch_buffer.extend(data)
        self._unacknowledged_bytes += len(data)
        # Check flow control
        if self._unacknowledged_bytes > self.FLOW_CONTROL_PAUSE and not self._paused:
            self._pause_output()
        # Schedule batch flush if not already scheduled
        if self._batch_timer is None:
            loop = asyncio.get_event_loop()
            self._batch_timer = loop.call_later(
                self.BATCH_WINDOW_S,
                self._flush_batch_sync,
            )
    def _flush_batch_sync(self) -> None:
        """Synchronous entry point for batch flush (called from event loop)."""
        self._batch_timer = None
        if not self._batch_buffer or not self._websockets:
            self._batch_buffer.clear()
            return
        payload = bytes(self._batch_buffer)
        self._batch_buffer.clear()
        # Send to all websockets (asyncio.create_task for async send)
        dead_sockets = set()
        for ws in list(self._websockets):
            try:
                asyncio.create_task(self._send_bytes(ws, payload))
            except Exception:
                dead_sockets.add(ws)
        if dead_sockets:
            self._websockets -= dead_sockets
    async def _send_bytes(self, ws: Any, payload: bytes) -> None:
        """Send bytes to a single websocket, catching errors."""
        try:
            await ws.send_bytes(payload)
        except Exception:
            self._websockets.discard(ws)
    def acknowledge_data(self, char_count: int) -> None:
        """Client acknowledges processing char_count bytes.
        Called from the WebSocket handler when the client sends an 'ack' message.
        """
        self._unacknowledged_bytes = max(0, self._unacknowledged_bytes - char_count)
        if self._paused and self._unacknowledged_bytes < self.FLOW_CONTROL_RESUME:
            self._resume_output()
        # Reset ack timeout
        if self._ack_timeout_handle:
            self._ack_timeout_handle.cancel()
        loop = asyncio.get_event_loop()
        self._ack_timeout_handle = loop.call_later(5.0, self._ack_timeout_fallback)
    def _ack_timeout_fallback(self) -> None:
        """If no ack received for 5s, assume client is dead and resume."""
        logger.warning(
            "Flow control ack timeout for session %s, resuming output",
            self.session_id,
        )
        self._unacknowledged_bytes = 0
        if self._paused:
            self._resume_output()
    def _pause_output(self) -> None:
        """Pause reading from PTY due to flow control."""
        self._paused = True
        self._stop_reading()
        logger.debug(
            "Paused output for session %s (%d unacked)",
            self.session_id,
            self._unacknowledged_bytes,
        )
    def _resume_output(self) -> None:
        """Resume reading from PTY."""
        self._paused = False
        self._start_reading()
        logger.debug("Resumed output for session %s", self.session_id)
    def get_buffer(self) -> bytes:
        """Get buffered output for replay."""
        return b"".join(self._output_buffer)
    def _handle_eof(self) -> None:
        """Handle PTY EOF: process died, close websockets to force reconnect."""
        self._stop_reading()
        # Mark process as done so is_alive() returns False
        if self.process is not None and self.process.returncode is None:
            # Force returncode to a non-None value since the process is dead
            # but asyncio.subprocess may not have set it yet
            try:
                self.process._transport.close()  # type: ignore[attr-defined]
            except Exception:
                pass
        # Close all websockets to force frontend reconnection
        dead_sockets = set(self._websockets)
        self._websockets.clear()
        for ws in dead_sockets:
            try:
                asyncio.create_task(
                    ws.close(code=4001, reason="Session process exited")
                )
            except Exception:
                pass
        logger.info("Session %s EOF handled, websockets closed", self.session_id)
    async def write_input(self, data: bytes) -> None:
        """Write input to the PTY master."""
        if self._master_fd is None or self._closed:
            return
-        with contextlib.suppress(OSError):
+        try:
            os.write(self._master_fd, data)
            self.last_activity = time.time()
        except (OSError, IOError) as exc:
            logger.debug("PTY write error for session %s: %s", self.session_id, exc)
            self._handle_eof()
    def _set_terminal_size(self, cols: int, rows: int) -> None:
        """Set the terminal size using TIOCSWINSZ."""
        if self._master_fd is None:
            logger.warning("Cannot resize: master_fd is None (session not started)")
            return
        TIOCSWINSZ = 0x5414
        size = struct.pack("HHHH", rows, cols, 0, 0)
        try:
            fcntl.ioctl(self._master_fd, TIOCSWINSZ, size)
            logger.debug("Resized PTY to %sx%s (fd=%s)", cols, rows, self._master_fd)
        except (OSError, IOError) as e:
            logger.error("Failed to resize PTY: %s", e)
    async def resize(self, cols: int, rows: int) -> None:
        """Resize the terminal."""
        if self._closed:
            logger.warning("Cannot resize: session is closed")
            return
        if cols == self._cols and rows == self._rows:
            return
        self._cols = cols
        self._rows = rows
        logger.debug(
            "resize() called for session %s: %sx%s", self.session_id, cols, rows
        )
        self._set_terminal_size(cols, rows)
-    def get_exit_reason(self) -> str | None:
+        # Send SIGWINCH to docker exec process
-        """Return the reason the session ended, if known."""
+        if self.process and self.process.pid:
-        return self._exit_reason
+            try:
                os.kill(self.process.pid, signal.SIGWINCH)
            except ProcessLookupError:
                logger.warning("docker exec process %s not found", self.process.pid)
            except Exception as e:
                logger.warning("Failed to send SIGWINCH: %s", e)
    async def reset(self) -> None:
        """Reset the session by killing the process and clearing state."""
        self.status = "resetting"
        await self.close()
        self._closed = False
        self._output_buffer.clear()
        self._buffer_size = 0
        self._websockets.clear()
        self._batch_buffer.clear()
        self._batch_timer = None
        self._unacknowledged_bytes = 0
        self._paused = False
        self._read_handler_set = False
        self.process = None
        self._master_fd = None
        self.status = "active"
    async def close(self) -> None:
        """Close the session and cleanup."""
        if self._closed:
            return
        self._closed = True
        self.status = "closed"
-        # Determine exit reason
+        self._stop_reading()
-        if self.process is not None and self.process.returncode is not None:
+
-            if self.process.returncode == 0:
+        if self._batch_timer:
-                self._exit_reason = "process_exit"
+            self._batch_timer.cancel()
-            else:
+            self._batch_timer = None
-                self._exit_reason = "process_exit"
+
-        else:
+        if self._ack_timeout_handle:
-            self._exit_reason = "timeout"
+            self._ack_timeout_handle.cancel()
            self._ack_timeout_handle = None
        if self._master_fd is not None:
-            with contextlib.suppress(OSError):
+            try:
                os.close(self._master_fd)
            except OSError:
                pass
            self._master_fd = None
        if self.process is not None:
            try:
                self.process.kill()
                await asyncio.wait_for(self.process.wait(), timeout=2.0)
-            except (TimeoutError, ProcessLookupError):
+            except (asyncio.TimeoutError, ProcessLookupError):
                pass
    def is_alive(self) -> bool:
@@ -160,3 +427,41 @@ class TerminalSession:
        if self.process is None:
            return False
        return self.process.returncode is None
    def is_idle(self) -> bool:
        """Check if the session has been idle for too long."""
        if self._websockets:
            return False
        return time.time() - self.last_activity > self.IDLE_TIMEOUT
    def attach_websocket(self, websocket: Any) -> None:
        """Attach a WebSocket to this session."""
        self._websockets.add(websocket)
        self.last_activity = time.time()
    def detach_websocket(self, websocket: Any) -> None:
        """Detach a WebSocket from this session."""
        self._websockets.discard(websocket)
    def has_websockets(self) -> bool:
        """Check if any WebSockets are attached."""
        return len(self._websockets) > 0
    async def send_to_all(self, data: bytes) -> None:
        """Send data to all attached WebSockets (used for control messages)."""
        dead_sockets = set()
        for ws in self._websockets:
            try:
                await ws.send_bytes(data)
            except Exception:
                dead_sockets.add(ws)
        for ws in dead_sockets:
            self._websockets.discard(ws)
    async def read_output(self) -> bytes:
        """Legacy method: read output synchronously.
        With event-driven I/O, output is automatically sent to websockets.
        This method returns any buffered data for callers that poll.
        """
        return b""
@@ -60,12 +60,9 @@ def get_commit_history(repo_path: str, branch: str | None = None, limit: int = 1
    Returns structured data including commits, branches, and graph information.
    """
-    # Get list of branches (may fail for empty repos)
+    # Get list of branches
    try:
    branches_output = _run_git_command(repo_path, ["branch", "-a", "--format=%(refname:short)"])
    branches = [b.strip() for b in branches_output.strip().split("\n") if b.strip()]
    except RuntimeError:
        branches = []
    # Build git log command - use NULL bytes as separators to avoid parsing issues
    log_args = [
@@ -79,16 +76,7 @@ def get_commit_history(repo_path: str, branch: str | None = None, limit: int = 1
    else:
        log_args.append("--all")
    try:
    log_output = _run_git_command(repo_path, log_args)
    except RuntimeError:
        # Empty repo or no commits
        return {
            "commits": [],
            "branches": branches,
            "total_commits": 0,
            "graph_data": {"nodes": [], "edges": []},
        }
    # Get branch info for each commit
    branch_map = _get_branch_map(repo_path)
@@ -125,11 +113,8 @@ def get_commit_history(repo_path: str, branch: str | None = None, limit: int = 1
        )
    # Get total commit count
    try:
    count_output = _run_git_command(repo_path, ["rev-list", "--all", "--count"])
    total_commits = int(count_output.strip()) if count_output.strip() else 0
    except RuntimeError:
        total_commits = 0
    # Build graph data and generate graph symbols
    graph_data = _build_graph_data(commits)
@@ -1,7 +1,4 @@
 """Integration tests for config profiles API."""
 import uuid
 import pytest
 from fastapi.testclient import TestClient
@@ -20,9 +17,7 @@ class TestConfigProfilesAPI:
        response = authenticated_client.get("/config-profiles")
        assert response.status_code == 200
        data = response.json()
-        assert isinstance(data, dict)
+        assert isinstance(data, list)
        assert "profiles" in data
        assert isinstance(data["profiles"], list)
    def test_create_config_profile_successfully(self, authenticated_client: TestClient) -> None:
        """Test creating a config profile."""
@@ -31,48 +26,99 @@ class TestConfigProfilesAPI:
            json={
                "name": "test-profile",
                "description": "Test profile",
                "env_vars": {"VAR": "value"},
                "runtime_hints": {"start_command": "npm start"},
                "mounts": [{"target": "/app", "mode": "rw", "files": {}}],
                "files": {"test.txt": "hello"},
            },
        )
        assert response.status_code == 201
        data = response.json()
        assert data["name"] == "test-profile"
-        assert data["description"] == "Test profile"
+        assert data["env_vars"] == {"VAR": "value"}
        assert data["files"] == {"test.txt": "hello"}
        assert data["mounts"][0]["target"] == "/app"
    def test_create_config_profile_duplicate_name(self, authenticated_client: TestClient) -> None:
        """Test that duplicate profile names are rejected."""
-        authenticated_client.post(
+        # Create first profile
            "/config-profiles",
            json={"name": "duplicate-profile"},
        )
        response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "duplicate-profile"},
+            json={
                "name": "duplicate-profile",
                "env_vars": {},
                "files": {},
            },
        )
        assert response.status_code == 201
        # Try to create second with same name
        response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "duplicate-profile",
                "env_vars": {},
                "files": {},
            },
        )
        assert response.status_code == 409
-    def test_create_config_profile_empty_name(self, authenticated_client: TestClient) -> None:
+    def test_create_config_profile_exceeds_size_limit(self, authenticated_client: TestClient) -> None:
-        """Test that empty profile names are rejected."""
+        """Test that profiles exceeding 10MB are rejected."""
        large_content = "x" * (11 * 1024 * 1024)  # 11MB
        response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "  "},
+            json={
                "name": "large-profile",
                "env_vars": {},
                "files": {"large.txt": large_content},
            },
        )
        assert response.status_code == 413
    def test_create_config_profile_invalid_file_path(self, authenticated_client: TestClient) -> None:
        """Test that invalid file paths are rejected."""
        response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "bad-profile",
                "env_vars": {},
                "files": {"../../../etc/passwd": "malicious"},
            },
        )
        assert response.status_code == 422
    def test_create_config_profile_invalid_mount_target(self, authenticated_client: TestClient) -> None:
        """Test that invalid mount targets are rejected."""
        response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "bad-mount-profile",
                "env_vars": {},
                "files": {},
                "mounts": [{"target": "relative/path", "mode": "rw", "files": {}}],
            },
        )
        assert response.status_code == 422
    def test_get_config_profile_by_id(self, authenticated_client: TestClient) -> None:
        """Test getting a config profile by ID."""
        # Create profile first
        create_response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "get-test"},
+            json={
                "name": "get-test",
                "env_vars": {},
                "files": {},
            },
        )
        profile_id = create_response.json()["id"]
        # Get it back
        response = authenticated_client.get(f"/config-profiles/{profile_id}")
        assert response.status_code == 200
        data = response.json()
        assert data["name"] == "get-test"
        assert "includes" in data
        assert "mounts" in data
    def test_get_config_profile_not_found(self, authenticated_client: TestClient) -> None:
        """Test getting a non-existent profile."""
@@ -81,381 +127,327 @@ class TestConfigProfilesAPI:
    def test_update_config_profile_successfully(self, authenticated_client: TestClient) -> None:
        """Test updating a config profile."""
        # Create profile first
        create_response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "update-test"},
+            json={
                "name": "update-test",
                "env_vars": {},
                "files": {},
            },
        )
        profile_id = create_response.json()["id"]
        # Update it
        response = authenticated_client.put(
            f"/config-profiles/{profile_id}",
-            json={"name": "updated-name", "description": "updated desc"},
+            json={
                "name": "updated-name",
                "env_vars": {"NEW_VAR": "new_value"},
            },
        )
        assert response.status_code == 200
        data = response.json()
        assert data["name"] == "updated-name"
-        assert data["description"] == "updated desc"
+        assert data["env_vars"] == {"NEW_VAR": "new_value"}
    def test_delete_config_profile_successfully(self, authenticated_client: TestClient) -> None:
        """Test deleting a config profile."""
        # Create profile first
        create_response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "delete-test"},
+            json={
                "name": "delete-test",
                "env_vars": {},
                "files": {},
            },
        )
        profile_id = create_response.json()["id"]
        # Delete it
        response = authenticated_client.delete(f"/config-profiles/{profile_id}")
        assert response.status_code == 204
        # Verify it's gone
        get_response = authenticated_client.get(f"/config-profiles/{profile_id}")
        assert get_response.status_code == 404
-    def test_profile_access_check(self, authenticated_client: TestClient) -> None:
+    def test_update_profile_includes_successfully(self, authenticated_client: TestClient) -> None:
-        """Test that users can only access their own profiles."""
+        """Test updating profile includes."""
-        # Create a profile
+        # Create base profile
        base_response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "base-profile",
                "env_vars": {"BASE_VAR": "base_value"},
                "files": {},
            },
        )
        base_id = base_response.json()["id"]
        # Create child profile
        child_response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "child-profile",
                "env_vars": {},
                "files": {},
            },
        )
        child_id = child_response.json()["id"]
        # Update includes
        response = authenticated_client.put(
            f"/config-profiles/{child_id}/includes",
            json={"includes": [base_id]},
        )
        assert response.status_code == 200
        data = response.json()
        print(f"Response data: {data}")
        print(f"Includes: {data.get('includes', 'NO INCLUDES KEY')}")
        assert len(data["includes"]) == 1, f"Expected 1 include, got {len(data.get('includes', []))}: {data.get('includes', [])}"
        assert data["includes"][0]["included_profile_id"] == base_id
    def test_update_profile_includes_cycle_detection(self, authenticated_client: TestClient) -> None:
        """Test that include cycles are detected."""
        # Create profile A
        a_response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "profile-a",
                "env_vars": {},
                "files": {},
            },
        )
        a_id = a_response.json()["id"]
        # Create profile B
        b_response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "profile-b",
                "env_vars": {},
                "files": {},
            },
        )
        b_id = b_response.json()["id"]
        # Make B include A
        authenticated_client.put(
            f"/config-profiles/{b_id}/includes",
            json={"includes": [a_id]},
        )
        # Try to make A include B (would create cycle)
        response = authenticated_client.put(
            f"/config-profiles/{a_id}/includes",
            json={"includes": [b_id]},
        )
        assert response.status_code == 400
    def test_preview_config_profile_successfully(self, authenticated_client: TestClient) -> None:
        """Test previewing a resolved config profile."""
        # Create base profile
        base_response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "preview-base",
                "env_vars": {"BASE_VAR": "base"},
                "files": {},
            },
        )
        base_id = base_response.json()["id"]
        # Create child profile
        child_response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "preview-child",
                "env_vars": {"CHILD_VAR": "child"},
                "files": {},
            },
        )
        child_id = child_response.json()["id"]
        # Make child include base
        authenticated_client.put(
            f"/config-profiles/{child_id}/includes",
            json={"includes": [base_id]},
        )
        # Preview child
        response = authenticated_client.get(f"/config-profiles/{child_id}/preview")
        assert response.status_code == 200
        data = response.json()
        assert data["profile_name"] == "preview-child"
        assert data["env_vars"]["BASE_VAR"] == "base"
        assert data["env_vars"]["CHILD_VAR"] == "child"
        assert len(data["included_profiles"]) == 1
    def test_resolve_default_profile(self, authenticated_client: TestClient) -> None:
        """Test resolving default profile for project/tool."""
        # Create a global default profile (no project/tool scoping)
        authenticated_client.post(
            "/config-profiles",
            json={
                "name": "default-profile",
                "env_vars": {},
                "files": {},
                "is_default": True,
            },
        )
        # Resolve default with random project/tool (should fall back to global)
        project_id = str(uuid.uuid4())
        tool_type_id = str(uuid.uuid4())
        response = authenticated_client.get(
            "/config-profiles/defaults/resolve",
            params={"project_id": project_id, "tool_type_id": tool_type_id},
        )
        assert response.status_code == 200
        data = response.json()
        assert data["profile_name"] == "default-profile"
    def test_resolve_default_profile_no_match(self, authenticated_client: TestClient) -> None:
        """Test resolving default profile when no profiles exist."""
        project_id = str(uuid.uuid4())
        tool_type_id = str(uuid.uuid4())
        response = authenticated_client.get(
            "/config-profiles/defaults/resolve",
            params={"project_id": project_id, "tool_type_id": tool_type_id},
        )
        assert response.status_code == 200
        data = response.json()
        assert data["profile_id"] is None
    def test_create_config_profile_with_git_mounts(self, authenticated_client: TestClient, test_project_and_repo) -> None:
        """Test creating a config profile with git mounts."""
        _project_id, repo_id = test_project_and_repo
        response = authenticated_client.post(
            "/config-profiles",
            json={
                "name": "git-mount-profile",
                "env_vars": {},
                "files": {},
                "git_mounts": [
                    {
                        "remote_url": "https://github.com/user/repo.git",
                        "source_path": ".",
                        "target_path": "/app",
                        "branch": "main",
                    }
                ],
            },
        )
        assert response.status_code == 201
        data = response.json()
        assert data["name"] == "git-mount-profile"
        assert len(data["git_mounts"]) == 1
        assert data["git_mounts"][0]["target_path"] == "/app"
        assert data["git_mounts"][0]["branch"] == "main"
    def test_update_config_profile_git_mounts(self, authenticated_client: TestClient, test_project_and_repo) -> None:
        """Test updating git mounts on a config profile."""
        _project_id, repo_id = test_project_and_repo
        # Create profile first
        create_response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "access-test"},
+            json={
                "name": "update-git-mounts",
                "env_vars": {},
                "files": {},
            },
        )
        profile_id = create_response.json()["id"]
-        # The profile should be accessible
+        # Update with git mounts
        response = authenticated_client.get(f"/config-profiles/{profile_id}")
        assert response.status_code == 200
@pytest.mark.integration
 class TestConfigProfileIncludes:
    """Integration tests for config profile includes."""
    def test_add_include_successfully(self, authenticated_client: TestClient) -> None:
        """Test adding an include to a profile."""
        # Create two profiles
        profile1 = authenticated_client.post(
            "/config-profiles",
            json={"name": "profile-1"},
        ).json()
        profile2 = authenticated_client.post(
            "/config-profiles",
            json={"name": "profile-2"},
        ).json()
        # Add include
        response = authenticated_client.post(
            f"/config-profiles/{profile1['id']}/includes",
            json={"included_profile_id": profile2["id"], "order_index": 0},
        )
        assert response.status_code == 201
        data = response.json()
        assert data["included_profile_id"] == profile2["id"]
        assert data["included_profile_name"] == "profile-2"
    def test_add_self_include_rejected(self, authenticated_client: TestClient) -> None:
        """Test that self-includes are rejected."""
        profile = authenticated_client.post(
            "/config-profiles",
            json={"name": "self-include-test"},
        ).json()
        response = authenticated_client.post(
            f"/config-profiles/{profile['id']}/includes",
            json={"included_profile_id": profile["id"], "order_index": 0},
        )
        assert response.status_code == 400
    def test_add_include_cycle_rejected(self, authenticated_client: TestClient) -> None:
        """Test that circular includes are rejected."""
        profile1 = authenticated_client.post(
            "/config-profiles",
            json={"name": "cycle-1"},
        ).json()
        profile2 = authenticated_client.post(
            "/config-profiles",
            json={"name": "cycle-2"},
        ).json()
        # Add profile1 includes profile2
        authenticated_client.post(
            f"/config-profiles/{profile1['id']}/includes",
            json={"included_profile_id": profile2["id"], "order_index": 0},
        )
        # Try to add profile2 includes profile1 (creates cycle)
        response = authenticated_client.post(
            f"/config-profiles/{profile2['id']}/includes",
            json={"included_profile_id": profile1["id"], "order_index": 0},
        )
        assert response.status_code == 400
    def test_add_deep_cycle_rejected(self, authenticated_client: TestClient) -> None:
        """Test that deep circular includes are rejected."""
        p1 = authenticated_client.post(
            "/config-profiles", json={"name": "deep-1"}
        ).json()
        p2 = authenticated_client.post(
            "/config-profiles", json={"name": "deep-2"}
        ).json()
        p3 = authenticated_client.post(
            "/config-profiles", json={"name": "deep-3"}
        ).json()
        # p1 -> p2 -> p3
        authenticated_client.post(
            f"/config-profiles/{p1['id']}/includes",
            json={"included_profile_id": p2["id"], "order_index": 0},
        )
        authenticated_client.post(
            f"/config-profiles/{p2['id']}/includes",
            json={"included_profile_id": p3["id"], "order_index": 0},
        )
        # Try p3 -> p1 (creates cycle)
        response = authenticated_client.post(
            f"/config-profiles/{p3['id']}/includes",
            json={"included_profile_id": p1["id"], "order_index": 0},
        )
        assert response.status_code == 400
    def test_add_duplicate_include_rejected(self, authenticated_client: TestClient) -> None:
        """Test that duplicate includes are rejected."""
        p1 = authenticated_client.post(
            "/config-profiles", json={"name": "dup-1"}
        ).json()
        p2 = authenticated_client.post(
            "/config-profiles", json={"name": "dup-2"}
        ).json()
        authenticated_client.post(
            f"/config-profiles/{p1['id']}/includes",
            json={"included_profile_id": p2["id"], "order_index": 0},
        )
        response = authenticated_client.post(
            f"/config-profiles/{p1['id']}/includes",
            json={"included_profile_id": p2["id"], "order_index": 1},
        )
        assert response.status_code == 409
    def test_list_includes(self, authenticated_client: TestClient) -> None:
        """Test listing includes for a profile."""
        p1 = authenticated_client.post(
            "/config-profiles", json={"name": "list-inc-1"}
        ).json()
        p2 = authenticated_client.post(
            "/config-profiles", json={"name": "list-inc-2"}
        ).json()
        authenticated_client.post(
            f"/config-profiles/{p1['id']}/includes",
            json={"included_profile_id": p2["id"], "order_index": 0},
        )
        response = authenticated_client.get(f"/config-profiles/{p1['id']}/includes")
        assert response.status_code == 200
        data = response.json()
        assert len(data["includes"]) == 1
    def test_update_include_order(self, authenticated_client: TestClient) -> None:
        """Test updating include order index."""
        p1 = authenticated_client.post(
            "/config-profiles", json={"name": "order-1"}
        ).json()
        p2 = authenticated_client.post(
            "/config-profiles", json={"name": "order-2"}
        ).json()
        inc = authenticated_client.post(
            f"/config-profiles/{p1['id']}/includes",
            json={"included_profile_id": p2["id"], "order_index": 0},
        ).json()
        response = authenticated_client.put(
-            f"/config-profiles/{p1['id']}/includes/{inc['id']}",
+            f"/config-profiles/{profile_id}",
-            json={"order_index": 5},
+            json={
                "git_mounts": [
                    {
                        "remote_url": "https://github.com/user/repo.git",
                        "source_path": "config",
                        "target_path": "/config",
                    }
                ],
            },
        )
        assert response.status_code == 200
        assert response.json()["order_index"] == 5
    def test_remove_include(self, authenticated_client: TestClient) -> None:
        """Test removing an include."""
        p1 = authenticated_client.post(
            "/config-profiles", json={"name": "rem-1"}
        ).json()
        p2 = authenticated_client.post(
            "/config-profiles", json={"name": "rem-2"}
        ).json()
        inc = authenticated_client.post(
            f"/config-profiles/{p1['id']}/includes",
            json={"included_profile_id": p2["id"], "order_index": 0},
        ).json()
        response = authenticated_client.delete(
            f"/config-profiles/{p1['id']}/includes/{inc['id']}"
        )
        assert response.status_code == 204
@pytest.mark.integration
 class TestConfigProfileMounts:
    """Integration tests for config profile mounts."""
    def test_add_mount_successfully(self, authenticated_client: TestClient) -> None:
        """Test adding a mount to a profile."""
        profile = authenticated_client.post(
            "/config-profiles",
            json={"name": "mount-test"},
        ).json()
        response = authenticated_client.post(
            f"/config-profiles/{profile['id']}/mounts",
            json={"target_path": "/etc/config", "files": {"test.txt": "hello"}, "order_index": 0},
        )
        assert response.status_code == 201
        data = response.json()
-        assert data["target_path"] == "/etc/config"
+        assert len(data["git_mounts"]) == 1
-        assert data["files"] == {"test.txt": "hello"}
+        assert data["git_mounts"][0]["source_path"] == "config"
-    def test_add_mount_relative_path_rejected(self, authenticated_client: TestClient) -> None:
+    def test_create_config_profile_invalid_git_mount_source_path(self, authenticated_client: TestClient, test_project_and_repo) -> None:
-        """Test that relative mount paths are rejected."""
+        """Test that invalid git mount source paths are rejected."""
-        profile = authenticated_client.post(
+        _project_id, repo_id = test_project_and_repo
            "/config-profiles",
            json={"name": "rel-path-test"},
        ).json()
        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
+            "/config-profiles",
-            json={"target_path": "etc/config", "files": {"test.txt": "hello"}},
+            json={
                "name": "bad-git-mount",
                "env_vars": {},
                "files": {},
                "git_mounts": [
                    {
                        "remote_url": "https://github.com/user/repo.git",
                        "source_path": "/absolute/path",
                        "target_path": "/app",
                    }
                ],
            },
        )
        assert response.status_code == 422
-    def test_add_target_path_traversal_rejected(self, authenticated_client: TestClient) -> None:
+    def test_create_config_profile_invalid_git_mount_target_path_traversal(self, authenticated_client: TestClient, test_project_and_repo) -> None:
-        """Test that path traversal in mount paths is rejected."""
+        """Test that git mount target paths with traversal are rejected."""
-        profile = authenticated_client.post(
+        _project_id, repo_id = test_project_and_repo
            "/config-profiles",
            json={"name": "traversal-test"},
        ).json()
        response = authenticated_client.post(
-            f"/config-profiles/{profile['id']}/mounts",
+            "/config-profiles",
-            json={"target_path": "/etc/../passwd", "files": {"test.txt": "hello"}},
+            json={
                "name": "bad-git-mount-target",
                "env_vars": {},
                "files": {},
                "git_mounts": [
                    {
                        "remote_url": "https://github.com/user/repo.git",
                        "source_path": ".",
                        "target_path": "../../../etc/passwd",
                    }
                ],
            },
        )
        assert response.status_code == 422
-    def test_add_duplicate_mount_rejected(self, authenticated_client: TestClient) -> None:
+    def test_preview_config_profile_with_git_mounts(self, authenticated_client: TestClient, test_project_and_repo) -> None:
-        """Test that duplicate mount paths are rejected."""
+        """Test previewing a profile with git mounts."""
-        profile = authenticated_client.post(
+        _project_id, repo_id = test_project_and_repo
        # Create profile with git mounts
        create_response = authenticated_client.post(
            "/config-profiles",
-            json={"name": "dup-mount-test"},
+            json={
-        ).json()
+                "name": "preview-git-mounts",
-
+                "env_vars": {},
-        authenticated_client.post(
+                "files": {},
-            f"/config-profiles/{profile['id']}/mounts",
+                "git_mounts": [
-            json={"target_path": "/etc/config", "files": {"test.txt": "hello"}},
+                    {
                        "remote_url": "https://github.com/user/repo.git",
                        "source_path": ".",
                        "target_path": "/app",
                    }
                ],
            },
        )
        profile_id = create_response.json()["id"]
-        response = authenticated_client.post(
+        # Preview
-            f"/config-profiles/{profile['id']}/mounts",
+        response = authenticated_client.get(f"/config-profiles/{profile_id}/preview")
            json={"target_path": "/etc/config", "files": {"test.txt": "world"}},
        )
        assert response.status_code == 409
    def test_update_mount(self, authenticated_client: TestClient) -> None:
        """Test updating a mount."""
        profile = authenticated_client.post(
            "/config-profiles",
            json={"name": "update-mount-test"},
        ).json()
        mount = authenticated_client.post(
            f"/config-profiles/{profile['id']}/mounts",
            json={"target_path": "/old/path", "files": {"test.txt": "old"}},
        ).json()
        response = authenticated_client.put(
            f"/config-profiles/{profile['id']}/mounts/{mount['id']}",
            json={"target_path": "/new/path", "files": {"test.txt": "new"}, "order_index": 2},
        )
        assert response.status_code == 200
        data = response.json()
-        assert data["target_path"] == "/new/path"
+        assert len(data["git_mounts"]) == 1
-        assert data["files"] == {"test.txt": "new"}
+        assert data["git_mounts"][0]["remote_url"] == "https://github.com/user/repo.git"
        assert data["order_index"] == 2
    def test_remove_mount(self, authenticated_client: TestClient) -> None:
        """Test removing a mount."""
        profile = authenticated_client.post(
            "/config-profiles",
            json={"name": "rem-mount-test"},
        ).json()
        mount = authenticated_client.post(
            f"/config-profiles/{profile['id']}/mounts",
            json={"target_path": "/tmp/test", "files": {"test.txt": "x"}},
        ).json()
        response = authenticated_client.delete(
            f"/config-profiles/{profile['id']}/mounts/{mount['id']}"
        )
        assert response.status_code == 204
@pytest.mark.integration
 class TestConfigProfileDefaults:
    """Integration tests for default profile APIs."""
    def test_get_default_profiles_empty(self, authenticated_client: TestClient) -> None:
        """Test getting default profiles when none are set."""
        response = authenticated_client.get("/config-profiles/defaults")
        assert response.status_code == 200
        data = response.json()
        assert data["default_profiles"] == {}
    def test_set_default_profiles(self, authenticated_client: TestClient) -> None:
        """Test setting default profiles."""
        profile = authenticated_client.post(
            "/config-profiles",
            json={"name": "default-test"},
        ).json()
        response = authenticated_client.put(
            "/config-profiles/defaults",
            json={"default_profiles": {"code-server": profile["id"]}},
        )
        assert response.status_code == 200
        data = response.json()
        assert data["default_profiles"]["code-server"] == profile["id"]
    def test_set_default_profiles_invalid_profile(self, authenticated_client: TestClient) -> None:
        """Test setting default profiles with invalid profile ID."""
        response = authenticated_client.put(
            "/config-profiles/defaults",
            json={"default_profiles": {"code-server": str(uuid.uuid4())}},
        )
        assert response.status_code == 404
    def test_get_default_profile_for_tool_type(self, authenticated_client: TestClient) -> None:
        """Test getting default profile for a specific tool type."""
        profile = authenticated_client.post(
            "/config-profiles",
            json={"name": "tool-default-test"},
        ).json()
        authenticated_client.put(
            "/config-profiles/defaults",
            json={"default_profiles": {"jupyter-notebook": profile["id"]}},
        )
        response = authenticated_client.get("/config-profiles/defaults/jupyter-notebook")
        assert response.status_code == 200
        data = response.json()
        assert data["tool_type_id"] == "jupyter-notebook"
        assert data["profile_id"] == profile["id"]
    def test_get_default_profile_for_tool_type_not_set(self, authenticated_client: TestClient) -> None:
        """Test getting default profile when not set."""
        response = authenticated_client.get("/config-profiles/defaults/opencode")
        assert response.status_code == 200
        data = response.json()
        assert data["tool_type_id"] == "opencode"
        assert data["profile_id"] is None
@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 import asyncio
 import pytest
@@ -59,7 +59,7 @@ def _mint_token(user_id: str) -> str:
        subject=user_id,
        email="test@headquarter.local",
        name="Test User",
-        expires_at=datetime.now(timezone.utc) + timedelta(minutes=15),
+        expires_at=datetime.now(UTC) + timedelta(minutes=15),
    )
@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 import asyncio
 import pytest
@@ -59,7 +59,7 @@ def _mint_token(user_id: str) -> str:
        subject=user_id,
        email="test@headquarter.local",
        name="Test User",
-        expires_at=datetime.now(timezone.utc) + timedelta(minutes=15),
+        expires_at=datetime.now(UTC) + timedelta(minutes=15),
    )
@@ -1,5 +1,5 @@
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 import asyncio
 import io
@@ -83,7 +83,7 @@ def _create_auth_cookie(user_id: str) -> str:
        subject=user_id,
        email="test@headquarter.local",
        name="Test User",
-        expires_at=datetime.now(timezone.utc) + timedelta(minutes=15),
+        expires_at=datetime.now(UTC) + timedelta(minutes=15),
    )
@@ -39,18 +39,3 @@ def test_refresh_tokens_migration_has_expected_revision_chain() -> None:
    assert module.revision == "0002_refresh_tokens"
    assert module.down_revision == "0001_initial_schema"
@pytest.mark.unit
 def test_config_profiles_migration_has_expected_revision_chain() -> None:
    migration_path = Path(__file__).resolve().parents[2] / "alembic" / "versions" / "0013_add_config_profiles.py"
    spec = spec_from_file_location("add_config_profiles", migration_path)
    assert spec is not None
    assert spec.loader is not None
    module = module_from_spec(spec)
    spec.loader.exec_module(module)
    assert module.revision == "0013_add_config_profiles"
    assert module.down_revision == "0012_default_port_req"
@@ -1,463 +0,0 @@
 """Unit tests for the profile resolver service."""
 import uuid
 from unittest.mock import MagicMock
 import pytest
 from src.services.profile_resolver import (
    ProfileCycleError,
    ResolvedProfileOutput,
    resolve_profile,
 )
 def _make_profile(
    name: str,
    env_vars: dict[str, str] | None = None,
    start_command: str | None = None,
    working_directory: str | None = None,
    port: int | None = None,
    mounts: list[MagicMock] | None = None,
    includes: list[MagicMock] | None = None,
 ) -> MagicMock:
    """Create a mock ConfigProfile for testing."""
    profile = MagicMock()
    profile.id = uuid.uuid4()
    profile.name = name
    profile.environment_variables = env_vars or {}
    profile.start_command = start_command
    profile.working_directory = working_directory
    profile.port = port
    profile.mounts = mounts or []
    profile.includes = includes or []
    return profile
 def _make_include(included_profile: MagicMock, order_index: int = 0) -> MagicMock:
    """Create a mock ConfigInclude for testing."""
    include = MagicMock()
    include.included_profile = included_profile
    include.order_index = order_index
    return include
 def _make_mount(
    target_path: str,
    mode: str = "rw",
    files: dict[str, str] | None = None,
    order_index: int = 0,
 ) -> MagicMock:
    """Create a mock ConfigMount for testing."""
    mount = MagicMock()
    mount.target_path = target_path
    mount.mode = mode
    mount.files = files or {}
    mount.order_index = order_index
    return mount
 class TestResolveProfileBasic:
    """Tests for basic profile resolution without includes."""
    def test_empty_profile(self) -> None:
        """Resolving an empty profile returns empty output."""
        profile = _make_profile("empty")
        result = resolve_profile(profile)
        assert isinstance(result, ResolvedProfileOutput)
        assert result.profile_name == "empty"
        assert result.environment_variables == {}
        assert result.runtime_hints.start_command is None
        assert result.runtime_hints.working_directory is None
        assert result.runtime_hints.port is None
        assert result.mounts == {}
        assert result.resolution_order == ["empty"]
    def test_env_vars_only(self) -> None:
        """Profile with env vars resolves correctly."""
        profile = _make_profile(
            "env-only",
            env_vars={"FOO": "bar", "BAZ": "qux"},
        )
        result = resolve_profile(profile)
        assert result.environment_variables == {"FOO": "bar", "BAZ": "qux"}
        assert result.env_var_sources == {
            "FOO": ["env-only"],
            "BAZ": ["env-only"],
        }
    def test_runtime_hints_only(self) -> None:
        """Profile with runtime hints resolves correctly."""
        profile = _make_profile(
            "hints-only",
            start_command="python app.py",
            working_directory="/app",
            port=8080,
        )
        result = resolve_profile(profile)
        assert result.runtime_hints.start_command == "python app.py"
        assert result.runtime_hints.working_directory == "/app"
        assert result.runtime_hints.port == 8080
        assert result.runtime_hints.overridden_hints == {
            "start_command": "hints-only",
            "working_directory": "hints-only",
            "port": "hints-only",
        }
    def test_mounts_only(self) -> None:
        """Profile with mounts resolves correctly."""
        profile = _make_profile(
            "mounts-only",
            mounts=[
                _make_mount(
                    "/config",
                    mode="ro",
                    files={"settings.json": '{"key": "value"}'},
                ),
            ],
        )
        result = resolve_profile(profile)
        assert "/config" in result.mounts
        mount = result.mounts["/config"]
        assert mount.target_path == "/config"
        assert mount.mode == "ro"
        assert mount.files == {"settings.json": '{"key": "value"}'}
 class TestResolveProfileIncludes:
    """Tests for profile resolution with includes."""
    def test_single_include(self) -> None:
        """Profile with one include resolves in correct order."""
        base = _make_profile("base", env_vars={"FOO": "base"})
        derived = _make_profile(
            "derived",
            env_vars={"BAR": "derived"},
            includes=[_make_include(base, order_index=0)],
        )
        result = resolve_profile(derived)
        assert result.resolution_order == ["derived", "base"]
        assert result.environment_variables == {
            "FOO": "base",
            "BAR": "derived",
        }
    def test_multiple_includes_ordered(self) -> None:
        """Multiple includes are resolved in order_index order."""
        first = _make_profile("first", env_vars={"KEY": "first"})
        second = _make_profile("second", env_vars={"KEY": "second"})
        main = _make_profile(
            "main",
            includes=[
                _make_include(first, order_index=0),
                _make_include(second, order_index=1),
            ],
        )
        result = resolve_profile(main)
        assert result.resolution_order == ["main", "first", "second"]
        # second overrides first
        assert result.environment_variables == {"KEY": "second"}
        assert result.env_var_sources["KEY"] == ["first", "second"]
    def test_include_order_matters(self) -> None:
        """Changing include order changes resolution."""
        a = _make_profile("a", env_vars={"KEY": "a"})
        b = _make_profile("b", env_vars={"KEY": "b"})
        main1 = _make_profile(
            "main",
            includes=[
                _make_include(a, order_index=0),
                _make_include(b, order_index=1),
            ],
        )
        main2 = _make_profile(
            "main",
            includes=[
                _make_include(b, order_index=0),
                _make_include(a, order_index=1),
            ],
        )
        result1 = resolve_profile(main1)
        result2 = resolve_profile(main2)
        assert result1.environment_variables["KEY"] == "b"
        assert result2.environment_variables["KEY"] == "a"
    def test_nested_includes(self) -> None:
        """Deeply nested includes resolve recursively."""
        deep = _make_profile("deep", env_vars={"DEEP": "value"})
        mid = _make_profile(
            "mid",
            env_vars={"MID": "value"},
            includes=[_make_include(deep, order_index=0)],
        )
        top = _make_profile(
            "top",
            env_vars={"TOP": "value"},
            includes=[_make_include(mid, order_index=0)],
        )
        result = resolve_profile(top)
        assert result.resolution_order == ["top", "mid", "deep"]
        assert result.environment_variables == {
            "TOP": "value",
            "MID": "value",
            "DEEP": "value",
        }
 class TestResolveProfileOverrides:
    """Tests for deterministic override rules."""
    def test_env_var_override(self) -> None:
        """Later layers override earlier env vars."""
        base = _make_profile("base", env_vars={"KEY": "base"})
        override = _make_profile("override", env_vars={"KEY": "override"})
        main = _make_profile(
            "main",
            includes=[
                _make_include(base, order_index=0),
                _make_include(override, order_index=1),
            ],
        )
        result = resolve_profile(main)
        assert result.environment_variables["KEY"] == "override"
        assert result.env_var_sources["KEY"] == ["base", "override"]
    def test_main_profile_wins_over_includes(self) -> None:
        """The main profile itself wins over all includes."""
        base = _make_profile("base", env_vars={"KEY": "base"})
        main = _make_profile(
            "main",
            env_vars={"KEY": "main"},
            includes=[_make_include(base, order_index=0)],
        )
        result = resolve_profile(main)
        assert result.environment_variables["KEY"] == "main"
        assert result.env_var_sources["KEY"] == ["base", "main"]
    def test_runtime_hint_override(self) -> None:
        """Later layers override earlier runtime hints."""
        base = _make_profile("base", start_command="python old.py")
        override = _make_profile("override", start_command="python new.py")
        main = _make_profile(
            "main",
            includes=[
                _make_include(base, order_index=0),
                _make_include(override, order_index=1),
            ],
        )
        result = resolve_profile(main)
        assert result.runtime_hints.start_command == "python new.py"
        assert result.runtime_hints.overridden_hints["start_command"] == "override"
    def test_mount_file_override(self) -> None:
        """Later layers override earlier files in the same mount."""
        base = _make_profile(
            "base",
            mounts=[
                _make_mount(
                    "/config",
                    files={"app.json": '{"v": 1}'},
                ),
            ],
        )
        override = _make_profile(
            "override",
            mounts=[
                _make_mount(
                    "/config",
                    files={"app.json": '{"v": 2}'},
                ),
            ],
        )
        main = _make_profile(
            "main",
            includes=[
                _make_include(base, order_index=0),
                _make_include(override, order_index=1),
            ],
        )
        result = resolve_profile(main)
        mount = result.mounts["/config"]
        assert mount.files["app.json"] == '{"v": 2}'
        assert mount.overridden_files["app.json"] == ["override"]
    def test_mount_mode_override(self) -> None:
        """Later layers override mount mode."""
        base = _make_profile(
            "base",
            mounts=[_make_mount("/data", mode="ro")],
        )
        override = _make_profile(
            "override",
            mounts=[_make_mount("/data", mode="rw")],
        )
        main = _make_profile(
            "main",
            includes=[
                _make_include(base, order_index=0),
                _make_include(override, order_index=1),
            ],
        )
        result = resolve_profile(main)
        assert result.mounts["/data"].mode == "rw"
        assert result.mounts["/data"].mode_overridden_by == "override"
    def test_mount_file_merge(self) -> None:
        """Different files in the same mount are merged."""
        base = _make_profile(
            "base",
            mounts=[
                _make_mount(
                    "/config",
                    files={"a.json": "1"},
                ),
            ],
        )
        override = _make_profile(
            "override",
            mounts=[
                _make_mount(
                    "/config",
                    files={"b.json": "2"},
                ),
            ],
        )
        main = _make_profile(
            "main",
            includes=[
                _make_include(base, order_index=0),
                _make_include(override, order_index=1),
            ],
        )
        result = resolve_profile(main)
        mount = result.mounts["/config"]
        assert mount.files == {"a.json": "1", "b.json": "2"}
 class TestResolveProfileCycles:
    """Tests for cycle detection during resolution."""
    def test_direct_cycle(self) -> None:
        """A -> B -> A is detected."""
        a = _make_profile("a")
        b = _make_profile("b", includes=[_make_include(a, order_index=0)])
        a.includes = [_make_include(b, order_index=0)]
        with pytest.raises(ProfileCycleError) as exc_info:
            resolve_profile(a)
        assert "a" in exc_info.value.cycle_path
        assert "b" in exc_info.value.cycle_path
    def test_indirect_cycle(self) -> None:
        """A -> B -> C -> A is detected."""
        a = _make_profile("a")
        c = _make_profile("c")
        b = _make_profile("b", includes=[_make_include(c, order_index=0)])
        a.includes = [_make_include(b, order_index=0)]
        c.includes = [_make_include(a, order_index=0)]
        with pytest.raises(ProfileCycleError) as exc_info:
            resolve_profile(a)
        assert "a" in exc_info.value.cycle_path
        assert "b" in exc_info.value.cycle_path
        assert "c" in exc_info.value.cycle_path
    def test_self_cycle(self) -> None:
        """A -> A is detected."""
        a = _make_profile("a")
        a.includes = [_make_include(a, order_index=0)]
        with pytest.raises(ProfileCycleError) as exc_info:
            resolve_profile(a)
        assert exc_info.value.cycle_path == ["a", "a"]
    def test_cycle_does_not_partially_resolve(self) -> None:
        """Cycle detection prevents any partial resolution."""
        a = _make_profile("a", env_vars={"A": "a"})
        b = _make_profile("b", env_vars={"B": "b"})
        a.includes = [_make_include(b, order_index=0)]
        b.includes = [_make_include(a, order_index=0)]
        with pytest.raises(ProfileCycleError):
            resolve_profile(a)
 class TestResolveProfileDiamond:
    """Tests for diamond-shaped include graphs."""
    def test_diamond_resolution(self) -> None:
        """Diamond graph resolves correctly without duplication issues."""
        base = _make_profile("base", env_vars={"BASE": "base"})
        left = _make_profile(
            "left",
            env_vars={"LEFT": "left"},
            includes=[_make_include(base, order_index=0)],
        )
        right = _make_profile(
            "right",
            env_vars={"RIGHT": "right"},
            includes=[_make_include(base, order_index=0)],
        )
        top = _make_profile(
            "top",
            env_vars={"TOP": "top"},
            includes=[
                _make_include(left, order_index=0),
                _make_include(right, order_index=1),
            ],
        )
        result = resolve_profile(top)
        # base should appear once (via left, then right skips because visited)
        assert result.resolution_order == ["top", "left", "base", "right"]
        assert result.environment_variables == {
            "TOP": "top",
            "LEFT": "left",
            "RIGHT": "right",
            "BASE": "base",
        }
    def test_diamond_override(self) -> None:
        """Diamond graph with conflicting overrides resolves correctly."""
        base = _make_profile("base", env_vars={"KEY": "base"})
        left = _make_profile(
            "left",
            env_vars={"KEY": "left"},
            includes=[_make_include(base, order_index=0)],
        )
        right = _make_profile(
            "right",
            env_vars={"KEY": "right"},
            includes=[_make_include(base, order_index=0)],
        )
        top = _make_profile(
            "top",
            includes=[
                _make_include(left, order_index=0),
                _make_include(right, order_index=1),
            ],
        )
        result = resolve_profile(top)
        # right wins because it's later
        assert result.environment_variables["KEY"] == "right"
        assert result.env_var_sources["KEY"] == ["base", "left", "right"]
        # Note: base appears once because visited set skips duplicate resolution in diamond graphs
@@ -1,112 +0,0 @@
 """Unit tests for TerminalManager."""
 from unittest.mock import AsyncMock, MagicMock, patch
 import pytest
 from src.services.terminal_manager import TerminalManager
 from src.services.terminal_session import TerminalSession
@pytest.fixture
 def manager():
    return TerminalManager()
@pytest.fixture
 def mock_websocket():
    ws = AsyncMock()
    ws.send_bytes = AsyncMock()
    ws.send_json = AsyncMock()
    ws.close = AsyncMock()
    ws.receive = AsyncMock()
    return ws
@pytest.fixture
 def mock_session():
    session = MagicMock(spec=TerminalSession)
    session.session_id = "sess-123"
    session.is_alive.return_value = True
    session._closed = False
    session.read_output = AsyncMock(return_value=b"")
    session.write_input = AsyncMock()
    session.resize = AsyncMock()
    session.close = AsyncMock()
    session.get_exit_reason.return_value = None
    return session
 class TestCreateSession:
    @patch("src.services.terminal_manager.asyncio.create_task")
    @patch("src.services.terminal_manager.uuid.uuid4", return_value="sess-123")
    async def test_create_session_registers_and_starts_loops(
        self, mock_uuid, mock_create_task, manager, mock_websocket
    ):
        instance_id = __import__("uuid").uuid4()
        mock_sess = MagicMock()
        mock_sess.session_id = "sess-123"
        mock_sess.is_alive.return_value = True
        mock_sess._closed = False
        mock_sess.start = AsyncMock()
        mock_sess.read_output = AsyncMock(return_value=b"")
        mock_sess.write_input = AsyncMock()
        mock_sess.resize = AsyncMock()
        mock_sess.close = AsyncMock()
        mock_sess.get_exit_reason.return_value = None
        with (
            patch.object(manager, "_read_loop", new=AsyncMock()),
            patch.object(manager, "_write_loop", new=AsyncMock()),
            patch.object(manager, "_heartbeat_loop", new=AsyncMock()),
            patch(
                "src.services.terminal_manager.TerminalSession",
                return_value=mock_sess,
            ),
        ):
            session = await manager.create_session(
                instance_id, "container-abc", mock_websocket
            )
            assert session.session_id == "sess-123"
            assert "sess-123" in manager._sessions
            assert "sess-123" in manager._last_client_message
 class TestHandleControlMessage:
    async def test_handle_resize(self, manager, mock_session, mock_websocket):
        ctrl = {"type": "resize", "cols": 120, "rows": 40}
        await manager._handle_control_message(mock_session, mock_websocket, ctrl)
        mock_session.resize.assert_awaited_once_with(120, 40)
    async def test_handle_ping(self, manager, mock_session, mock_websocket):
        ctrl = {"type": "ping", "id": 42}
        await manager._handle_control_message(mock_session, mock_websocket, ctrl)
        mock_websocket.send_json.assert_awaited_once_with({"type": "pong", "id": 42})
    async def test_handle_unknown_type(self, manager, mock_session, mock_websocket):
        ctrl = {"type": "unknown", "data": "test"}
        await manager._handle_control_message(mock_session, mock_websocket, ctrl)
        mock_websocket.send_json.assert_not_awaited()
        mock_session.resize.assert_not_awaited()
 class TestCleanupSession:
    async def test_cleanup_removes_session(self, manager, mock_session):
        manager._sessions["sess-123"] = mock_session
        manager._last_client_message["sess-123"] = 123.0
        await manager._cleanup_session(mock_session)
        assert "sess-123" not in manager._sessions
        assert "sess-123" not in manager._last_client_message
        mock_session.close.assert_awaited_once()
 class TestCloseAll:
    async def test_close_all_clears_sessions(self, manager, mock_session):
        manager._sessions["sess-123"] = mock_session
        manager._last_client_message["sess-123"] = 123.0
        await manager.close_all()
        assert len(manager._sessions) == 0
        assert len(manager._last_client_message) == 0
        mock_session.close.assert_awaited_once()
@@ -1,168 +0,0 @@
 """Unit tests for TerminalSession."""
 import asyncio
 from unittest.mock import MagicMock, patch
 import pytest
 from src.services.terminal_session import TerminalSession
@pytest.fixture
 def mock_pty():
    """Mock pty.openpty to return predictable fds."""
    master_fd = 10
    slave_fd = 11
    with (
        patch(
            "src.services.terminal_session.pty.openpty",
            return_value=(master_fd, slave_fd),
        ),
        patch("src.services.terminal_session.os.close") as mock_close,
    ):
        yield master_fd, slave_fd, mock_close
 class TestTerminalSessionStart:
    def test_init_state(self, mock_pty):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        assert session.session_id == "sess-1"
        assert session.container_id == "container-abc"
        assert session._echo_enabled is True
        assert session._exit_reason is None
 class TestTerminalSessionEchoDetection:
    @patch("src.services.terminal_session.termios.tcgetattr")
    def test_detect_echo_state_enabled(self, mock_tcgetattr):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        # termios.ECHO flag set
        attrs = [[], [], [], __import__("termios").ECHO, [], [], []]
        mock_tcgetattr.return_value = attrs
        result = session._detect_echo_state()
        assert result is True
    @patch("src.services.terminal_session.termios.tcgetattr")
    def test_detect_echo_state_disabled(self, mock_tcgetattr):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        # termios.ECHO flag NOT set
        attrs = [[], [], [], 0, [], [], []]
        mock_tcgetattr.return_value = attrs
        result = session._detect_echo_state()
        assert result is False
    def test_detect_echo_state_no_master_fd(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = None
        result = session._detect_echo_state()
        assert result is True  # default
 class TestTerminalSessionResize:
    @patch("src.services.terminal_session.fcntl.ioctl")
    def test_resize_sets_size(self, mock_ioctl):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        # Should not raise
        asyncio.run(session.resize(120, 40))
        mock_ioctl.assert_called_once()
    def test_resize_when_closed(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._closed = True
        # Should not raise
        asyncio.run(session.resize(120, 40))
 class TestTerminalSessionWriteInput:
    @patch("src.services.terminal_session.os.write")
    def test_write_input(self, mock_write):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        asyncio.run(session.write_input(b"hello"))
        mock_write.assert_called_once_with(10, b"hello")
    def test_write_input_when_closed(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._closed = True
        # Should not raise
        asyncio.run(session.write_input(b"hello"))
 class TestTerminalSessionReadOutput:
    @patch("src.services.terminal_session.select.select")
    @patch("src.services.terminal_session.os.read")
    def test_read_output_with_data(self, mock_read, mock_select):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        mock_select.return_value = ([10], [], [])
        mock_read.return_value = b"output"
        result = asyncio.run(session.read_output())
        assert result == b"output"
    @patch("src.services.terminal_session.select.select")
    def test_read_output_no_data(self, mock_select):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        mock_select.return_value = ([], [], [])
        result = asyncio.run(session.read_output())
        assert result == b""
 class TestTerminalSessionClose:
    @patch("src.services.terminal_session.os.close")
    @patch("src.services.terminal_session.asyncio.wait_for")
    async def test_close_sets_exit_reason(self, mock_wait_for, mock_close):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._master_fd = 10
        session.process = MagicMock()
        session.process.returncode = 0
        await session.close()
        assert session._exit_reason == "process_exit"
        assert session._closed is True
    async def test_close_idempotent(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session._closed = True
        # Should not raise
        await session.close()
 class TestTerminalSessionIsAlive:
    def test_is_alive_with_running_process(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session.process = MagicMock()
        session.process.returncode = None
        assert session.is_alive() is True
    def test_is_alive_with_exited_process(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session.process = MagicMock()
        session.process.returncode = 0
        assert session.is_alive() is False
    def test_is_alive_no_process(self):
        session = TerminalSession("sess-1", __import__("uuid").uuid4(), "container-abc")
        session.process = None
        assert session.is_alive() is False
@@ -19,8 +19,8 @@
        "tailwindcss": "^3.3.0",
        "xterm": "^5.3.0",
        "xterm-addon-fit": "^0.8.0",
-        "xterm-addon-serialize": "^0.11.0",
+        "xterm-addon-web-links": "^0.9.0",
-        "xterm-addon-web-links": "^0.9.0"
+        "xterm-addon-webgl": "^0.16.0"
      },
      "devDependencies": {
        "@testing-library/jest-dom": "^6.9.1",
@@ -1391,9 +1391,6 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1411,9 +1408,6 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1431,9 +1425,6 @@
        "ppc64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1451,9 +1442,6 @@
        "s390x"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1471,9 +1459,6 @@
        "x64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1491,9 +1476,6 @@
        "x64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1672,9 +1654,6 @@
        "arm"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1689,9 +1668,6 @@
        "arm"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1706,9 +1682,6 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1723,9 +1696,6 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1740,9 +1710,6 @@
        "loong64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1757,9 +1724,6 @@
        "loong64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1774,9 +1738,6 @@
        "ppc64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1791,9 +1752,6 @@
        "ppc64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1808,9 +1766,6 @@
        "riscv64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1825,9 +1780,6 @@
        "riscv64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1842,9 +1794,6 @@
        "s390x"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1859,9 +1808,6 @@
        "x64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1876,9 +1822,6 @@
        "x64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -4361,9 +4304,6 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MPL-2.0",
      "optional": true,
      "os": [
@@ -4385,9 +4325,6 @@
        "arm64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MPL-2.0",
      "optional": true,
      "os": [
@@ -4409,9 +4346,6 @@
        "x64"
      ],
      "dev": true,
      "libc": [
        "glibc"
      ],
      "license": "MPL-2.0",
      "optional": true,
      "os": [
@@ -4433,9 +4367,6 @@
        "x64"
      ],
      "dev": true,
      "libc": [
        "musl"
      ],
      "license": "MPL-2.0",
      "optional": true,
      "os": [
@@ -6373,16 +6304,6 @@
        "xterm": "^5.0.0"
      }
    },
    "node_modules/xterm-addon-serialize": {
      "version": "0.11.0",
      "resolved": "https://registry.npmjs.org/xterm-addon-serialize/-/xterm-addon-serialize-0.11.0.tgz",
      "integrity": "sha512-2CNDnmLdLkNWfsxNFkGsI5FE9W/BbsMzeOrbu59yNqH9L6k1gmL+Ab6VXxEp2NQUJSzaiqi6t0nFR5k5EDkVIg==",
      "deprecated": "This package is now deprecated. Move to @xterm/addon-serialize instead.",
      "license": "MIT",
      "peerDependencies": {
        "xterm": "^5.0.0"
      }
    },
    "node_modules/xterm-addon-web-links": {
      "version": "0.9.0",
      "resolved": "https://registry.npmjs.org/xterm-addon-web-links/-/xterm-addon-web-links-0.9.0.tgz",
@@ -6393,6 +6314,16 @@
        "xterm": "^5.0.0"
      }
    },
    "node_modules/xterm-addon-webgl": {
      "version": "0.16.0",
      "resolved": "https://registry.npmjs.org/xterm-addon-webgl/-/xterm-addon-webgl-0.16.0.tgz",
      "integrity": "sha512-E8cq1AiqNOv0M/FghPT+zPAEnvIQRDbAbkb04rRYSxUym69elPWVJ4sv22FCLBqM/3LcrmBLl/pELnBebVFKgA==",
      "deprecated": "This package is now deprecated. Move to @xterm/addon-webgl instead.",
      "license": "MIT",
      "peerDependencies": {
        "xterm": "^5.0.0"
      }
    },
    "node_modules/yallist": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
@@ -22,8 +22,8 @@
    "tailwindcss": "^3.3.0",
    "xterm": "^5.3.0",
    "xterm-addon-fit": "^0.8.0",
-    "xterm-addon-serialize": "^0.11.0",
+    "xterm-addon-web-links": "^0.9.0",
-    "xterm-addon-web-links": "^0.9.0"
+    "xterm-addon-webgl": "^0.16.0"
  },
  "devDependencies": {
    "@testing-library/jest-dom": "^6.9.1",
@@ -1,82 +0,0 @@
 #!/usr/bin/env node
 /* eslint-disable */
 /**
 * Verifies repository structure conventions.
 * Run with: node scripts/check-structure.js
 */
 import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const SRC_DIR = path.join(__dirname, "..", "src");
 let errors = 0;
 let warnings = 0;
 // Known acceptable deviations — documented in naming.md
 const OVERSIZE_ALLOWLIST = [
 	// Form-heavy admin tabs: 15+ fields each, splitting would create micro-components
 	"components/features/tool-workshop/ToolTypesTab.tsx",
 	// Complex terminal hook: WS lifecycle + ping-pong + echo + resize debouncing
 	"hooks/use-terminal-connection.ts",
 	// Terminal component: xterm lifecycle + resize observer + overlay UI
 	"components/features/terminal/TerminalComponent.tsx",
 	// Instance list with health polling + inline confirmations
 	"components/features/session/InstanceList.tsx",
 	// Dialog with form validation + SSH key handling
 	"components/features/project/RepositoryCreateDialog.tsx",
 	// Test files: complex test coverage
 	"hooks/use-terminal-connection.test.ts",
 	"pages/ToolWorkshopPage.test.tsx",
 	// Global utility CSS: will be further split in future iteration
 	"styles/utilities.css",
 ];
 function checkFileSize(filePath, maxLines = 300) {
 	const content = fs.readFileSync(filePath, "utf-8");
 	const lines = content.split("\n").length;
 	const relative = path.relative(SRC_DIR, filePath);
 	if (lines > maxLines) {
 		if (OVERSIZE_ALLOWLIST.includes(relative)) {
 			console.warn(`⚠️  OVERSIZED (${lines} lines, allowlisted): ${relative}`);
 			warnings++;
 		} else {
 			console.error(`❌ OVERSIZED (${lines} lines): ${relative}`);
 			errors++;
 		}
 	}
 }
 function walk(dir, callback) {
 	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
 		const fullPath = path.join(dir, entry.name);
 		if (entry.isDirectory()) {
 			if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
 			walk(fullPath, callback);
 		} else {
 			callback(fullPath);
 		}
 	}
 }
 console.log("Checking file sizes...\n");
 walk(SRC_DIR, (filePath) => {
 	const ext = path.extname(filePath);
 	if ([".ts", ".tsx", ".py", ".css"].includes(ext)) {
 		checkFileSize(filePath);
 	}
 });
 console.log("\n---");
 if (errors === 0 && warnings === 0) {
 	console.log("✅ All checks passed!");
 	process.exit(0);
 } else if (errors === 0) {
 	console.log(`✅ All checks passed with ${warnings} warning(s)`);
 	process.exit(0);
 } else {
 	console.log(`❌ ${errors} error(s), ${warnings} warning(s)`);
 	process.exit(1);
 }
@@ -1,212 +0,0 @@
 import { apiClient } from "./client";
 import type {
 	CommitDetail,
 	CommitHistoryResponse,
 	CommitResponse,
 	GitRepository,
 	GitRepositoryCreate,
 	GitStatus,
 	MergeResponse,
 	URLParseResult,
 } from "../types/git-repository";
 export type {
 	CommitDetail,
 	CommitHistoryEntry,
 	CommitHistoryResponse,
 	CommitResponse,
 	GitRepository,
 	GitRepositoryCreate,
 	GitStatus,
 	MergeResponse,
 	URLParseResult,
 } from "../types/git-repository";
 export interface Branch {
 	name: string;
 	is_default: boolean;
 	last_commit: string | null;
 }
 export interface BranchesResponse {
 	branches: Branch[];
 	default_branch: string;
 }
 export async function parseGitUrl(url: string): Promise<URLParseResult> {
 	const response = await apiClient.post("/projects/repositories/parse-url", {
 		url,
 	});
 	return response.data;
 }
 export async function listRepositories(
 	projectId: string,
 ): Promise<GitRepository[]> {
 	const response = await apiClient.get(`/projects/${projectId}/repositories`);
 	return response.data;
 }
 export async function listRepositoryBranches(
 	projectId: string,
 	repoId: string,
 ): Promise<BranchesResponse> {
 	const response = await apiClient.get(
 		`/projects/${projectId}/repositories/${repoId}/branches`,
 	);
 	return response.data;
 }
 export async function createRepository(
 	projectId: string,
 	data: GitRepositoryCreate,
 ): Promise<GitRepository> {
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories`,
 		data,
 	);
 	return response.data;
 }
 export async function deleteRepository(
 	projectId: string,
 	repoId: string,
 ): Promise<void> {
 	await apiClient.delete(`/projects/${projectId}/repositories/${repoId}`);
 }
 export async function getRepositoryHistory(
 	projectId: string,
 	repoId: string,
 	branch?: string,
 	limit?: number,
 ): Promise<CommitHistoryResponse> {
 	const searchParams = new URLSearchParams();
 	if (branch) searchParams.set("branch", branch);
 	if (limit) searchParams.set("limit", String(limit));
 	const queryString = searchParams.toString();
 	const params = queryString ? `?${queryString}` : "";
 	const response = await apiClient.get(
 		`/projects/${projectId}/repositories/${repoId}/history${params}`,
 	);
 	return response.data;
 }
 export async function getCommitDetail(
 	projectId: string,
 	repoId: string,
 	commitHash: string,
 ): Promise<CommitDetail> {
 	const response = await apiClient.get(
 		`/projects/${projectId}/repositories/${repoId}/commits/${commitHash}`,
 	);
 	return response.data;
 }
 export async function getRepositoryStatus(
 	projectId: string,
 	repoId: string,
 ): Promise<GitStatus> {
 	const response = await apiClient.get(
 		`/projects/${projectId}/repositories/${repoId}/status`,
 	);
 	return response.data;
 }
 export async function createBranch(
 	projectId: string,
 	repoId: string,
 	name: string,
 	baseBranch: string = "HEAD",
 ): Promise<{ message: string; branch: string }> {
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/branches`,
 		{ name, base_branch: baseBranch },
 	);
 	return response.data;
 }
 export async function deleteBranch(
 	projectId: string,
 	repoId: string,
 	branchName: string,
 	force: boolean = false,
 ): Promise<{ message: string }> {
 	const response = await apiClient.delete(
 		`/projects/${projectId}/repositories/${repoId}/branches/${branchName}?force=${force}`,
 	);
 	return response.data;
 }
 export async function checkoutBranch(
 	projectId: string,
 	repoId: string,
 	branch: string,
 ): Promise<{ message: string; branch: string }> {
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/checkout`,
 		{ branch },
 	);
 	return response.data;
 }
 export async function commitChanges(
 	projectId: string,
 	repoId: string,
 	message: string,
 	files?: string[],
 ): Promise<CommitResponse> {
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/commit`,
 		{ message, files },
 	);
 	return response.data;
 }
 export async function fetchRepository(
 	projectId: string,
 	repoId: string,
 ): Promise<{ message: string }> {
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/fetch`,
 	);
 	return response.data;
 }
 export async function pullRepository(
 	projectId: string,
 	repoId: string,
 	branch?: string,
 ): Promise<{ message: string }> {
 	const params = branch ? `?branch=${branch}` : "";
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/pull${params}`,
 	);
 	return response.data;
 }
 export async function pushRepository(
 	projectId: string,
 	repoId: string,
 	branch?: string,
 ): Promise<{ message: string }> {
 	const params = branch ? `?branch=${branch}` : "";
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/push${params}`,
 	);
 	return response.data;
 }
 export async function mergeBranches(
 	projectId: string,
 	repoId: string,
 	sourceBranch: string,
 	targetBranch?: string,
 	message?: string,
 ): Promise<MergeResponse> {
 	const response = await apiClient.post(
 		`/projects/${projectId}/repositories/${repoId}/merge`,
 		{ source_branch: sourceBranch, target_branch: targetBranch, message },
 	);
 	return response.data;
 }
@@ -0,0 +1,299 @@
 import { apiClient } from "./client";
 export interface GitRepository {
  id: string;
  name: string;
  path: string;
  project_id: string;
  owner_id: string;
  is_mirror: boolean;
  remote_url: string | null;
  ssh_key_id: string | null;
  last_push: string | null;
  created_at: string | null;
 }
 export interface GitRepositoryCreate {
  name: string;
  remote_url?: string;
  force_original_url?: boolean;
  ssh_key_id?: string;
 }
 export interface URLParseResult {
  original_url: string;
  base_url: string | null;
  is_valid_clone_url: boolean;
  needs_parsing: boolean;
  host: string | null;
  message: string;
  error_code: string | null;
 }
 export async function parseGitUrl(url: string): Promise<URLParseResult> {
  const response = await apiClient.post("/repositories/parse-url", { url });
  return response.data;
 }
 export async function listRepositories(projectId?: string): Promise<GitRepository[]> {
  if (projectId) {
    const response = await apiClient.get<GitRepository[]>(
      `/projects/${projectId}/repositories`
    );
    return response.data;
  }
  // List all user repositories (including external)
  const response = await apiClient.get<GitRepository[]>("/repositories");
  return response.data;
 }
 export async function listAllUserRepositories(): Promise<GitRepository[]> {
  const response = await apiClient.get<GitRepository[]>("/repositories");
  return response.data;
 }
 export async function createRepository(
  projectId: string,
  data: GitRepositoryCreate
 ): Promise<GitRepository> {
  const response = await apiClient.post(`/projects/${projectId}/repositories`, data);
  return response.data;
 }
 export async function createExternalRepository(
  data: GitRepositoryCreate
 ): Promise<GitRepository> {
  const response = await apiClient.post<GitRepository>("/repositories", data);
  return response.data;
 }
 export async function deleteRepository(projectId: string, repoId: string): Promise<void> {
  await apiClient.delete(`/projects/${projectId}/repositories/${repoId}`);
 }
 export async function updateRepositorySshKey(
  projectId: string,
  repoId: string,
  sshKeyId: string | null
 ): Promise<GitRepository> {
  const response = await apiClient.patch(
    `/projects/${projectId}/repositories/${repoId}/ssh-key`,
    { ssh_key_id: sshKeyId }
  );
  return response.data;
 }
 export interface Branch {
  name: string;
  is_default: boolean;
  last_commit: string | null;
 }
 export interface BranchesResponse {
  branches: Branch[];
  default_branch: string;
 }
 export async function listRepositoryBranches(
  projectId: string,
  repoId: string
 ): Promise<BranchesResponse> {
  const response = await apiClient.get(
    `/projects/${projectId}/repositories/${repoId}/branches`
  );
  return response.data;
 }
 export interface CommitHistoryEntry {
  hash: string;
  short_hash: string;
  message: string;
  author_name: string;
  author_email: string;
  author_date: string;
  refs: string[];
  graph_symbol: string;
  graph_depth: number;
 }
 export interface CommitHistoryResponse {
  commits: CommitHistoryEntry[];
  branches: string[];
  tags: string[];
 }
 export async function getRepositoryHistory(
  projectId: string,
  repoId: string,
  branch?: string,
  limit?: number
 ): Promise<CommitHistoryResponse> {
  const searchParams = new URLSearchParams();
  if (branch) searchParams.set("branch", branch);
  if (limit) searchParams.set("limit", String(limit));
  const queryString = searchParams.toString();
  const params = queryString ? `?${queryString}` : "";
  const response = await apiClient.get(`/projects/${projectId}/repositories/${repoId}/history${params}`);
  return response.data;
 }
 export interface CommitDetail {
  hash: string;
  short_hash: string;
  message: string;
  author_name: string;
  author_email: string;
  author_date: string;
  committer_name: string;
  committer_email: string;
  committer_date: string;
  stats: {
    additions: number;
    deletions: number;
    files_changed: number;
  };
  diff: string;
  parents: string[];
 }
 export async function getCommitDetail(
  projectId: string,
  repoId: string,
  commitHash: string
 ): Promise<CommitDetail> {
  const response = await apiClient.get(
    `/projects/${projectId}/repositories/${repoId}/commits/${commitHash}`
  );
  return response.data;
 }
 // Git Control API
 export interface GitStatus {
  branch: string;
  modified: string[];
  added: string[];
  deleted: string[];
  untracked: string[];
  renamed: string[];
  ahead: number;
  behind: number;
 }
 export async function getRepositoryStatus(
  projectId: string,
  repoId: string
 ): Promise<GitStatus> {
  const response = await apiClient.get(
    `/projects/${projectId}/repositories/${repoId}/status`
  );
  return response.data;
 }
 export async function createBranch(
  projectId: string,
  repoId: string,
  name: string,
  baseBranch: string = "HEAD"
 ): Promise<{ message: string; branch: string }> {
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/branches`,
    { name, base_branch: baseBranch }
  );
  return response.data;
 }
 export async function deleteBranch(
  projectId: string,
  repoId: string,
  branchName: string,
  force: boolean = false
 ): Promise<{ message: string }> {
  const response = await apiClient.delete(
    `/projects/${projectId}/repositories/${repoId}/branches/${branchName}?force=${force}`
  );
  return response.data;
 }
 export async function checkoutBranch(
  projectId: string,
  repoId: string,
  branch: string
 ): Promise<{ message: string; branch: string }> {
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/checkout`,
    { branch }
  );
  return response.data;
 }
 export interface CommitResponse {
  commit_hash: string;
  message: string;
 }
 export async function commitChanges(
  projectId: string,
  repoId: string,
  message: string,
  files?: string[]
 ): Promise<CommitResponse> {
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/commit`,
    { message, files }
  );
  return response.data;
 }
 export async function fetchRepository(
  projectId: string,
  repoId: string
 ): Promise<{ message: string }> {
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/fetch`
  );
  return response.data;
 }
 export async function pullRepository(
  projectId: string,
  repoId: string,
  branch?: string
 ): Promise<{ message: string }> {
  const params = branch ? `?branch=${branch}` : "";
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/pull${params}`
  );
  return response.data;
 }
 export async function pushRepository(
  projectId: string,
  repoId: string,
  branch?: string
 ): Promise<{ message: string }> {
  const params = branch ? `?branch=${branch}` : "";
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/push${params}`
  );
  return response.data;
 }
 export interface MergeResponse {
  commit_hash: string;
  message: string;
 }
 export async function mergeBranches(
  projectId: string,
  repoId: string,
  sourceBranch: string,
  targetBranch?: string,
  message?: string
 ): Promise<MergeResponse> {
  const response = await apiClient.post(
    `/projects/${projectId}/repositories/${repoId}/merge`,
    { source_branch: sourceBranch, target_branch: targetBranch, message }
  );
  return response.data;
 }
@@ -1,20 +1,38 @@
 import { AxiosError } from "axios";
 import { apiClient } from "./client";
 import type { Session } from "../types/session";
 import type { ToolInstance } from "../types/tool-instance";
-export type { Session } from "../types/session";
+export interface ToolInstance {
-export type { ToolInstance } from "../types/tool-instance";
+	id: string;
 	name: string;
 	display_name: string;
 	tool_type_id: string;
 	tool_type_name: string;
 	tool_type_interfaces: string[];
 	status: string;
 	url: string | null;
 	port: number | null;
 	selected_config_profile_id: string | null;
 	ssh_key_ids: string[];
 	created_at: string;
 }
-export interface InstanceHealth {
+export interface Session {
-	healthy: boolean;
+	id: string;
-	container_status: string;
+	display_name: string;
-	container_health: string | null;
+	tool_type_name: string;
-	container_exit_code: number | null;
+	tool_icon: string;
-	tunnel_status: string;
+	tool_type_interfaces: string[];
-	tunnel_status_code: number | null;
+	repository_name: string;
-	probe_status: string;
+	repository_id: string;
-	last_probe_output: string | null;
+	project_name: string;
-	error: string | null;
+	project_id: string;
 	status: string;
 	url: string | null;
 	container_status?: string;
 	probe_status?: string;
 	clone_mode?: string;
 	branch?: string | null;
 	created_at?: string;
 }
 export async function listInstances(
@@ -32,11 +50,11 @@ export async function createInstance(
 	repoId: string,
 	toolTypeId: string,
 	displayName?: string,
-	_cloneMode?: string,
+	cloneMode?: string,
-	_branch?: string,
+	branch?: string,
-	_newBranch?: string,
+	newBranch?: string,
 	configProfileId?: string,
-	_sshKeyIds?: string[],
+	sshKeyIds?: string[],
 	workspaceId?: string,
 ): Promise<ToolInstance> {
 	const response = await apiClient.post(
@@ -45,7 +63,11 @@ export async function createInstance(
 			tool_type_id: toolTypeId,
 			display_name: displayName,
 			workspace_id: workspaceId || undefined,
-			config_profile_id: configProfileId || undefined,
+			clone_mode: cloneMode || "mount",
 			branch: branch || undefined,
 			new_branch: newBranch || undefined,
 			config_profile_id: configProfileId,
 			ssh_key_ids: sshKeyIds || [],
 		},
 	);
 	return response.data;
@@ -56,16 +78,31 @@ export async function startInstance(
 	repoId: string,
 	instanceId: string,
 	configProfileId?: string,
-	// eslint-disable-next-line @typescript-eslint/no-unused-vars
+	sshKeyIds?: string[],
-	_sshKeyIds?: string[],
+	retries = 2,
 	// eslint-disable-next-line @typescript-eslint/no-unused-vars
 	_retries?: number,
 ): Promise<{ status: string; url?: string }> {
 	try {
 		const response = await apiClient.post(
 			`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/start`,
-		{ config_profile_id: configProfileId },
+			{ config_profile_id: configProfileId, ssh_key_ids: sshKeyIds || [] },
 		);
 		return response.data;
 	} catch (error) {
 		// Retry on network errors (e.g. Docker creating network interfaces)
 		const axiosError = error as AxiosError;
 		if (retries > 0 && !axiosError.response) {
 			await new Promise((r) => setTimeout(r, 1500));
 			return startInstance(
 				projectId,
 				repoId,
 				instanceId,
 				configProfileId,
 				sshKeyIds,
 				retries - 1,
 			);
 		}
 		throw error;
 	}
 }
 export async function stopInstance(
@@ -83,11 +120,32 @@ export async function restartInstance(
 	projectId: string,
 	repoId: string,
 	instanceId: string,
 	configProfileId?: string,
 	sshKeyIds?: string[],
 	retries = 2,
 ): Promise<{ status: string; url?: string }> {
 	try {
 		const response = await apiClient.post(
 			`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/restart`,
 			{ config_profile_id: configProfileId, ssh_key_ids: sshKeyIds || [] },
 		);
 		return response.data;
 	} catch (error) {
 		// Retry on network errors (e.g. Docker creating network interfaces)
 		const axiosError = error as AxiosError;
 		if (retries > 0 && !axiosError.response) {
 			await new Promise((r) => setTimeout(r, 1500));
 			return restartInstance(
 				projectId,
 				repoId,
 				instanceId,
 				configProfileId,
 				sshKeyIds,
 				retries - 1,
 			);
 		}
 		throw error;
 	}
 }
 export async function deleteInstance(
@@ -96,10 +154,10 @@ export async function deleteInstance(
 	instanceId: string,
 	force?: boolean,
 ): Promise<void> {
-	const url = force
+	await apiClient.delete(
-		? `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}?force=true`
+		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}`,
-		: `/projects/${projectId}/repositories/${repoId}/instances/${instanceId}`;
+		{ params: { force } },
-	await apiClient.delete(url);
+	);
 }
 export async function getUserSessions(): Promise<Session[]> {
@@ -107,11 +165,23 @@ export async function getUserSessions(): Promise<Session[]> {
 	return response.data.sessions;
 }
 export interface InstanceHealth {
 	healthy: boolean;
 	container_status: string;
 	container_health: string | null;
 	container_exit_code: number | null;
 	tunnel_status: string;
 	tunnel_status_code: number | null;
 	probe_status: string;
 	last_probe_output: string | null;
 	error: string | null;
 }
 export async function checkInstanceHealth(
 	projectId: string,
 	repoId: string,
 	instanceId: string,
-): Promise<{ healthy: boolean; status_code: number | null; error?: string }> {
+): Promise<InstanceHealth> {
 	const response = await apiClient.get(
 		`/projects/${projectId}/repositories/${repoId}/instances/${instanceId}/health`,
 	);
@@ -1,51 +0,0 @@
 import { apiClient } from "./client";
 import type {
 	ToolType,
 	CreateToolTypeRequest,
 	UpdateToolTypeRequest,
 } from "../types/tool-type";
 export type {
 	ReadinessProbe,
 	ToolType,
 	CreateToolTypeRequest,
 	UpdateToolTypeRequest,
 } from "../types/tool-type";
 export const listToolTypes = async (): Promise<ToolType[]> => {
 	const response = await apiClient.get<ToolType[]>("/tool-types");
 	return response.data;
 };
 export const getToolType = async (id: string): Promise<ToolType> => {
 	const response = await apiClient.get<ToolType>(`/tool-types/${id}`);
 	return response.data;
 };
 export const createToolType = async (
 	data: CreateToolTypeRequest,
 ): Promise<ToolType> => {
 	const response = await apiClient.post<ToolType>("/tool-types", data);
 	return response.data;
 };
 export const updateToolType = async (
 	id: string,
 	data: UpdateToolTypeRequest,
 ): Promise<ToolType> => {
 	const response = await apiClient.put<ToolType>(`/tool-types/${id}`, data);
 	return response.data;
 };
 export const deleteToolType = async (id: string): Promise<void> => {
 	await apiClient.delete(`/tool-types/${id}`);
 };
 export const validateToolType = async (
 	id: string,
 ): Promise<{ valid: boolean; errors?: string[] }> => {
 	const response = await apiClient.get<{ valid: boolean; errors?: string[] }>(
 		`/tool-types/${id}/validate`,
 	);
 	return response.data;
 };
@@ -6,7 +6,7 @@ import {
  listToolTypes,
  updateToolType,
  validateToolType,
-} from "../api/tool-types";
+} from "../api/tool_types";
 const mockGet = vi.fn();
 const mockPost = vi.fn();
@@ -0,0 +1,102 @@
 import { apiClient } from "./client";
 export interface ReadinessProbe {
 	command: string;
 	timeout: number;
 	interval: number;
 }
 export interface ToolType {
 	id: string;
 	name: string;
 	display_name: string;
 	description: string | null;
 	category: string;
 	interface_type: string;
 	requires_port: boolean;
 	default_port: number | null;
 	definition_type: "compose" | "dockerfile" | "manifest";
 	manifest_id: string | null;
 	compose_template: string | null;
 	dockerfile_template: string | null;
 	build_context: Record<string, string> | null;
 	readiness_probe: ReadinessProbe | null;
 	startup_command: string | null;
 	required_variables: string[];
 	created_by_id: string | null;
 	created_at: string;
 	updated_at: string;
 }
 export interface CreateToolTypeRequest {
 	name: string;
 	display_name: string;
 	description?: string;
 	category?: string;
 	interface_type?: string;
 	requires_port?: boolean;
 	default_port: number;
 	definition_type?: "compose" | "dockerfile" | "manifest";
 	manifest_id?: string;
 	compose_template?: string;
 	dockerfile_template?: string;
 	build_context?: Record<string, string>;
 	readiness_probe?: ReadinessProbe;
 	startup_command?: string;
 	required_variables: string[];
 }
 export interface UpdateToolTypeRequest {
 	display_name?: string;
 	description?: string;
 	category?: string;
 	interface_type?: string;
 	requires_port?: boolean;
 	default_port?: number;
 	definition_type?: "compose" | "dockerfile" | "manifest";
 	manifest_id?: string;
 	compose_template?: string;
 	dockerfile_template?: string;
 	build_context?: Record<string, string>;
 	readiness_probe?: ReadinessProbe;
 	startup_command?: string;
 	required_variables?: string[];
 }
 export const listToolTypes = async (): Promise<ToolType[]> => {
 	const response = await apiClient.get<ToolType[]>("/tool-types");
 	return response.data;
 };
 export const getToolType = async (id: string): Promise<ToolType> => {
 	const response = await apiClient.get<ToolType>(`/tool-types/${id}`);
 	return response.data;
 };
 export const createToolType = async (
 	data: CreateToolTypeRequest,
 ): Promise<ToolType> => {
 	const response = await apiClient.post<ToolType>("/tool-types", data);
 	return response.data;
 };
 export const updateToolType = async (
 	id: string,
 	data: UpdateToolTypeRequest,
 ): Promise<ToolType> => {
 	const response = await apiClient.put<ToolType>(`/tool-types/${id}`, data);
 	return response.data;
 };
 export const deleteToolType = async (id: string): Promise<void> => {
 	await apiClient.delete(`/tool-types/${id}`);
 };
 export const validateToolType = async (
 	id: string,
 ): Promise<{ valid: boolean; errors?: string[] }> => {
 	const response = await apiClient.get<{ valid: boolean; errors?: string[] }>(
 		`/tool-types/${id}/validate`,
 	);
 	return response.data;
 };
@@ -0,0 +1,192 @@
 import { useCallback, useEffect } from "react";
 import { Link, NavLink, Outlet, useLocation } from "react-router-dom";
 import { getUserSessions } from "../api/sessions";
 import type { Session } from "../api/sessions";
 import { useTheme } from "../hooks/use-theme";
 import { useAuth } from "../state/auth";
 import { useSessions } from "../state/sessions";
 import { useMobileViewport } from "../hooks/use-mobile-viewport";
 import { EventProvider } from "../state/events";
 import { ToastProvider } from "../state/toast";
 import { NotificationProvider } from "../state/notifications";
 import { EventToastBridge } from "./event-toast-bridge";
 import { NotificationCenter } from "./notification-center";
 import { Icon } from "./icon";
 import { MobileNav } from "./mobile-nav";
 import { StartToolFAB } from "./start-tool-fab";
 import type { IconName } from "../utils/icons";
 const NAV_ITEMS: {
 	to: string;
 	label: string;
 	icon: IconName;
 	badge?: "sessions";
 }[] = [
 	{ to: "/", label: "Home", icon: "dashboard" },
 	{ to: "/sessions", label: "Sessions", icon: "terminal", badge: "sessions" },
 	{ to: "/workspaces", label: "Workspaces", icon: "folder" },
 	{ to: "/projects", label: "Projects", icon: "projects" },
 	{ to: "/tool-workshop", label: "Tool Workshop", icon: "settings" },
 	{ to: "/config-profiles", label: "Config Profiles", icon: "folder" },
 	{ to: "/settings", label: "Settings", icon: "settings" },
 ];
 const SessionItem = ({ session }: { session: Session }) => {
 	const isRunning = session.status === "running";
 	// Determine the link target:
 	// - Web tools open their tunnel URL
 	// - Terminal tools open the terminal page
 	// - Everything else falls back to the project page
 	const hasTerminal = session.tool_type_interfaces.includes("terminal");
 	const hasWeb = session.tool_type_interfaces.includes("web");
 	const href = session.url && hasWeb
 		? session.url
 		: hasTerminal
 			? `/instances/${session.id}/terminal`
 			: `/projects/${session.project_id}`;
 	return (
 		<a
 			href={href}
 			target="_blank"
 			rel="noopener noreferrer"
 			className="nav-item session-item"
 			title={`${session.display_name} (${session.status})`}
 		>
 			<span className={`session-status ${isRunning ? "running" : ""}`} />
 			<Icon name={session.tool_icon as IconName} size="sm" />
 			<span className="session-name">{session.display_name}</span>
 		</a>
 	);
 };
 export const AppShell = () => {
 	useTheme();
 	const { user, logout } = useAuth();
 	const { sessions, setAllSessions } = useSessions();
 	const location = useLocation();
 	const isMobile = useMobileViewport();
 	const isMobileTerminal =
 		isMobile &&
 		location.pathname.includes("/instances/") &&
 		location.pathname.includes("/terminal");
 	const loadSessions = useCallback(async () => {
 		try {
 			const data = await getUserSessions();
 			setAllSessions(data);
 		} catch {
 			// Silently fail - sessions are optional
 		}
 	}, [setAllSessions]);
 	useEffect(() => {
 		void loadSessions();
 		// Poll every 30 seconds (reduced from 10s to avoid ERR_NETWORK_CHANGED from Docker network changes)
 		const interval = setInterval(() => {
 			void loadSessions();
 		}, 30000);
 		return () => clearInterval(interval);
 	}, [loadSessions]);
 	if (isMobileTerminal) {
 		return (
 			<EventProvider>
 				<ToastProvider>
 					<NotificationProvider>
 						<EventToastBridge />
 						<div className="shell mobile-terminal-shell">
 							<Outlet />
 						</div>
 					</NotificationProvider>
 				</ToastProvider>
 			</EventProvider>
 		);
 	}
 	return (
 		<EventProvider>
 			<ToastProvider>
 				<NotificationProvider>
 					<EventToastBridge />
 					<div className="shell">
 						<header className="shell-header">
 							<Link className="brand" to="/">
 								Headquarter
 							</Link>
 							<div className="header-actions">
 								<NotificationCenter isMobileTerminal={isMobileTerminal} />
 								<Link className="user-chip" to="/profile">
 									{user?.name ?? "User"}
 								</Link>
 								<button
 									className="ghost-button"
 									onClick={() => {
 										void logout();
 									}}
 									type="button"
 								>
 									<Icon name="logout" size="sm" />
 									Logout
 								</button>
 							</div>
 						</header>
 						<div className="shell-body">
 							{!isMobile && (
 								<aside className="shell-nav" aria-label="Primary navigation">
 									{NAV_ITEMS.map((item) => {
 										const activeCount = sessions.filter(
 											(s) => s.status === "running",
 										).length;
 										return (
 											<NavLink
 												key={item.to}
 												to={item.to}
 												className={({ isActive }) =>
 													isActive ? "nav-item nav-item-active" : "nav-item"
 												}
 												end={item.to === "/"}
 											>
 												<Icon name={item.icon} size="sm" />
 												{item.label}
 												{item.badge === "sessions" && activeCount > 0 && (
 													<span className="nav-badge">{activeCount}</span>
 												)}
 											</NavLink>
 										);
 									})}
 									{sessions.length > 0 && (
 										<>
 											<div className="nav-divider" />
 											<div className="nav-section-title">Live sessions</div>
 											{sessions.map((session) => (
 												<SessionItem key={session.id} session={session} />
 											))}
 										</>
 									)}
 								</aside>
 							)}
 							<main className={`shell-content ${isMobile ? "mobile" : ""}`}>
 								<Outlet />
 							</main>
 						</div>
 						{isMobile && (
 							<MobileNav
 								sessionCount={
 									sessions.filter((s) => s.status === "running").length
 								}
 							/>
 						)}
 						<StartToolFAB />
 					</div>
 				</NotificationProvider>
 			</ToastProvider>
 		</EventProvider>
 	);
 };
@@ -1,6 +1,6 @@
 import React, { useEffect } from "react";
 import Editor from "react-simple-code-editor";
-import { highlightCode, loadLanguage } from "../../utils/language";
+import { highlightCode, loadLanguage } from "../utils/language";
 interface CodeEditorProps {
  value: string;
@@ -1,7 +1,6 @@
 import styles from "./CommitDialog.module.css";
 import React, { useState } from "react";
-import { Icon } from "../../ui/Icon";
+import { Icon } from "./icon";
 interface CommitDialogProps {
  isOpen: boolean;
@@ -72,40 +71,40 @@ export const CommitDialog: React.FC<CommitDialogProps> = ({
  const hasChanges = diff.some((d) => d.type !== "same");
  return (
-    <div className={styles.dialogOverlay}>
+    <div className="dialog-overlay">
-      <div className={styles.commitDialog}>
+      <div className="commit-dialog">
-        <div className={styles.dialogHeader}>
+        <div className="dialog-header">
          <h3>Commit Changes</h3>
-          <button className={styles.dialogClose} onClick={onCancel} type="button">
+          <button className="dialog-close" onClick={onCancel} type="button">
            ×
          </button>
        </div>
-        <div className={styles.dialogBody}>
+        <div className="dialog-body">
-          <p className={styles.fileInfo}>
+          <p className="file-info">
            Editing: <strong>{filePath}</strong>
          </p>
          {!hasChanges && (
-            <div className={styles.warningMessage}>No changes to commit</div>
+            <div className="warning-message">No changes to commit</div>
          )}
          {hasChanges && (
-            <div className={styles.diffPreview}>
+            <div className="diff-preview">
              <h4>Changes</h4>
-              <div className={styles.diffContent}>
+              <div className="diff-content">
                {diff.map((line, i) => (
                  <div
                    key={i}
-                    className={`${styles.diffLine} ${line.type === "added" ? styles.diffAdded : line.type === "removed" ? styles.diffRemoved : styles.diffSame}`}
+                    className={`diff-line diff-${line.type}`}
                  >
-                    <span className={styles.diffLineNumber}>{line.lineNum}</span>
+                    <span className="diff-line-number">{line.lineNum}</span>
-                    <span className={styles.diffMarker}>
+                    <span className="diff-marker">
                      {line.type === "added" && "+"}
                      {line.type === "removed" && "-"}
                      {line.type === "same" && " "}
                    </span>
-                    <span className={styles.diffLineContent}>{line.line}</span>
+                    <span className="diff-line-content">{line.line}</span>
                  </div>
                ))}
              </div>
@@ -126,7 +125,7 @@ export const CommitDialog: React.FC<CommitDialogProps> = ({
          {error && <div className="error-message">{error}</div>}
        </div>
-        <div className={styles.dialogFooter}>
+        <div className="dialog-footer">
          <button
            className="btn-secondary"
            onClick={onCancel}
@@ -0,0 +1,102 @@
 import { useState } from "react";
 import { commitChanges } from "../api/git_repositories";
 interface CommitPanelProps {
  projectId: string;
  repoId: string;
  modified: string[];
  added: string[];
  deleted: string[];
  untracked: string[];
  onCommit: () => void;
 }
 export const CommitPanel = ({
  projectId,
  repoId,
  modified,
  added,
  deleted,
  untracked,
  onCommit,
 }: CommitPanelProps) => {
  const [message, setMessage] = useState("");
  const [loading, setLoading] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const allFiles = [...modified, ...added, ...deleted, ...untracked];
  const hasChanges = allFiles.length > 0;
  const handleCommit = async () => {
    if (!message.trim()) {
      setError("Please enter a commit message");
      return;
    }
    setLoading(true);
    setError(null);
    try {
      await commitChanges(projectId, repoId, message);
      setMessage("");
      onCommit();
    } catch {
      setError("Commit failed. Please try again.");
    } finally {
      setLoading(false);
    }
  };
  if (!hasChanges) return null;
  return (
    <div className="commit-panel">
      <h4>Changes</h4>
      <div className="file-list">
        {modified.map((file) => (
          <div key={file} className="file-item modified">
            <span className="file-status">M</span>
            <span className="file-name">{file}</span>
          </div>
        ))}
        {added.map((file) => (
          <div key={file} className="file-item added">
            <span className="file-status">A</span>
            <span className="file-name">{file}</span>
          </div>
        ))}
        {deleted.map((file) => (
          <div key={file} className="file-item deleted">
            <span className="file-status">D</span>
            <span className="file-name">{file}</span>
          </div>
        ))}
        {untracked.map((file) => (
          <div key={file} className="file-item untracked">
            <span className="file-status">?</span>
            <span className="file-name">{file}</span>
          </div>
        ))}
      </div>
      <div className="commit-form">
        <textarea
          placeholder="Commit message"
          value={message}
          onChange={(e) => setMessage(e.target.value)}
          rows={2}
          className="commit-message-input"
        />
        {error && <div className="commit-error">{error}</div>}
        <button
          onClick={handleCommit}
          disabled={loading || !message.trim()}
          className="commit-button"
          type="button"
        >
          {loading ? "Committing..." : "Commit"}
        </button>
      </div>
    </div>
  );
 };
@@ -1,10 +1,10 @@
 import { useState, useEffect } from "react";
-import { Icon } from "@/components/ui/Icon";
+import { Icon } from "./icon";
 import { createInstance, startInstance, type ToolInstance } from "../api/sessions";
 import type { Project } from "../types";
-import { listRepositoryBranches, type GitRepository, type Branch } from "@/api/git-repositories";
+import { listRepositoryBranches, type GitRepository, type Branch } from "../api/git_repositories";
-import type { ToolType } from "@/api/tool-types";
+import type { ToolType } from "../api/tool_types";
-import { listSSHKeys, type SSHKey } from "@/api/ssh-keys";
+import { listSSHKeys, type SSHKey } from "../api/ssh_keys";
 import { listConfigProfiles, type ConfigProfile } from "../api/config_profiles";
 interface CreateSessionFormProps {
@@ -1,4 +1,4 @@
-import { Icon } from "@/components/ui/Icon";
+import { Icon } from "./icon";
 interface LoadingStateProps {
  message?: string;
@@ -1,86 +0,0 @@
 import type { Session } from "../../../types/session";
 import { Icon } from "../../ui/Icon";
 interface ActiveSessionsListProps {
 	sessions: Session[];
 	actionBusy: string | null;
 	onOpen: (session: Session) => void;
 	onStop: (session: Session) => void;
 	onDelete: (session: Session) => void;
 	onRecreateTunnel: (session: Session) => void;
 }
 export const ActiveSessionsList = ({
 	sessions,
 	actionBusy,
 	onOpen,
 	onStop,
 	onDelete,
 	onRecreateTunnel,
 }: ActiveSessionsListProps) => {
 	if (sessions.length === 0) {
 		return <p className="muted">No active sessions right now.</p>;
 	}
 	return (
 		<div className="home-session-grid">
 			{sessions.map((session) => (
 				<article className="card session-card" key={session.id}>
 					<div className="stack-sm">
 						<div className="row row-tight">
 							<h3>
 								{session.display_name ||
 									session.tool_type_name ||
 									"Unnamed Session"}
 							</h3>
 							<span className={`status-badge ${session.status}`}>
 								{session.status}
 							</span>
 						</div>
 						<p className="muted">
 							{session.project_name} · {session.repository_name}
 						</p>
 						<p className="muted">{session.tool_type_name}</p>
 					</div>
 					<div className="session-actions">
 						<button
 							className="secondary-button small"
 							type="button"
 							onClick={() => onOpen(session)}
 						>
 							<Icon name="external" size="sm" />
 							Open
 						</button>
 						<button
 							className="ghost-button small"
 							type="button"
 							onClick={() => void onRecreateTunnel(session)}
 							disabled={actionBusy === session.id}
 						>
 							<Icon name="refresh" size="sm" />
 							Tunnel
 						</button>
 						<button
 							className="ghost-button small"
 							type="button"
 							onClick={() => void onStop(session)}
 							disabled={actionBusy === session.id}
 						>
 							<Icon name="stop" size="sm" />
 							Stop
 						</button>
 						<button
 							className="ghost-button small danger-text"
 							type="button"
 							onClick={() => void onDelete(session)}
 							disabled={actionBusy === session.id}
 						>
 							<Icon name="delete" size="sm" />
 							Delete
 						</button>
 					</div>
 				</article>
 			))}
 		</div>
 	);
 };
@@ -1,34 +0,0 @@
 import type { DashboardSummary as DashboardSummaryType } from "../../../api/dashboard";
 interface DashboardSummaryProps {
 	summary: DashboardSummaryType;
 	activeSessionsCount: number;
 }
 const summaryCards = [
 	{ label: "Open sessions", key: "openSessions" },
 	{ label: "Projects", key: "projects" },
 	{ label: "Repositories", key: "repositories" },
 ] as const;
 export const DashboardSummary = ({
 	summary,
 	activeSessionsCount,
 }: DashboardSummaryProps) => {
 	return (
 		<div className="home-summary-grid">
 			{summaryCards.map((card) => (
 				<article className="card home-summary-card" key={card.label}>
 					<p className="card-label">{card.label}</p>
 					<p className="card-value">
 						{card.key === "openSessions"
 							? activeSessionsCount
 							: card.key === "projects"
 								? summary.projects
 								: summary.repositories}
 					</p>
 				</article>
 			))}
 		</div>
 	);
 };
@@ -1,40 +0,0 @@
 import type { Project } from "../../../types/project";
 interface ProjectsSectionProps {
 	projects: Project[];
 	onOpenProject: (projectId: string) => void;
 }
 export const ProjectsSection = ({
 	projects,
 	onOpenProject,
 }: ProjectsSectionProps) => {
 	if (projects.length === 0) {
 		return <p className="muted">No projects yet.</p>;
 	}
 	return (
 		<div className="home-project-grid">
 			{projects.map((project) => (
 				<article
 					className="card project-card home-project-card"
 					key={project.id}
 				>
 					<div className="stack-sm">
 						<h3>{project.name}</h3>
 						{project.description && (
 							<p className="muted">{project.description}</p>
 						)}
 					</div>
 					<button
 						className="ghost-button small"
 						type="button"
 						onClick={() => onOpenProject(project.id)}
 					>
 						Open Workspace
 					</button>
 				</article>
 			))}
 		</div>
 	);
 };
@@ -1,129 +0,0 @@
 import { useState } from "react";
 import type { Project } from "../../../types/project";
 import type { GitRepository } from "../../../types/git-repository";
 import type { ToolType } from "../../../types/tool-type";
 import { Icon } from "../../ui/Icon";
 interface QuickCreateFormProps {
 	projects: Project[];
 	repositories: GitRepository[];
 	toolTypes: ToolType[];
 	saveState: "idle" | "saving" | "error";
 	onSubmit: (data: {
 		projectId: string;
 		repoId: string;
 		toolTypeId: string;
 		displayName: string;
 	}) => void;
 	onProjectChange: (projectId: string) => void;
 }
 export const QuickCreateForm = ({
 	projects,
 	repositories,
 	toolTypes,
 	saveState,
 	onSubmit,
 	onProjectChange,
 }: QuickCreateFormProps) => {
 	const [selectedProject, setSelectedProject] = useState("");
 	const [selectedRepo, setSelectedRepo] = useState("");
 	const [selectedToolType, setSelectedToolType] = useState("");
 	const [displayName, setDisplayName] = useState("");
 	const handleProjectChange = (projectId: string) => {
 		setSelectedProject(projectId);
 		setSelectedRepo("");
 		onProjectChange(projectId);
 	};
 	const handleSubmit = (event: React.FormEvent) => {
 		event.preventDefault();
 		if (!selectedProject || !selectedRepo || !selectedToolType) return;
 		onSubmit({
 			projectId: selectedProject,
 			repoId: selectedRepo,
 			toolTypeId: selectedToolType,
 			displayName,
 		});
 	};
 	return (
 		<form className="stack create-session-form" onSubmit={handleSubmit}>
 			<div className="form-row">
 				<label className="form-field">
 					Project
 					<select
 						value={selectedProject}
 						onChange={(event) => handleProjectChange(event.target.value)}
 					>
 						<option value="">Select project...</option>
 						{projects.map((project) => (
 							<option key={project.id} value={project.id}>
 								{project.name}
 							</option>
 						))}
 					</select>
 				</label>
 				<label className="form-field">
 					Repository
 					<select
 						value={selectedRepo}
 						onChange={(event) => setSelectedRepo(event.target.value)}
 						disabled={!selectedProject}
 					>
 						<option value="">Select repository...</option>
 						{repositories.map((repo) => (
 							<option key={repo.id} value={repo.id}>
 								{repo.name}
 							</option>
 						))}
 					</select>
 				</label>
 				<label className="form-field">
 					Tool type
 					<select
 						value={selectedToolType}
 						onChange={(event) => setSelectedToolType(event.target.value)}
 					>
 						<option value="">Select tool...</option>
 						{toolTypes.map((tool) => (
 							<option key={tool.id} value={tool.id}>
 								{tool.display_name}
 							</option>
 						))}
 					</select>
 				</label>
 			</div>
 			<label className="form-field">
 				Display name
 				<input
 					type="text"
 					value={displayName}
 					onChange={(event) => setDisplayName(event.target.value)}
 					placeholder="My Development Environment"
 				/>
 			</label>
 			<div className="form-actions">
 				<button
 					className="primary-button"
 					type="submit"
 					disabled={saveState === "saving"}
 				>
 					{saveState === "saving" ? (
 						<>
 							<Icon name="loading" size="sm" /> Creating...
 						</>
 					) : (
 						<>
 							<Icon name="add" size="sm" /> Create Session
 						</>
 					)}
 				</button>
 				{saveState === "error" && (
 					<span className="error-text">Failed to create session</span>
 				)}
 			</div>
 		</form>
 	);
 };
@@ -1,47 +0,0 @@
 import type { Session } from "../../../types/session";
 interface RecentSessionsSectionProps {
 	sessions: Session[];
 	onOpen: (session: Session) => void;
 }
 export const RecentSessionsSection = ({
 	sessions,
 	onOpen,
 }: RecentSessionsSectionProps) => {
 	if (sessions.length === 0) return null;
 	return (
 		<section className="card stack home-section">
 			<div className="page-header">
 				<div>
 					<p className="eyebrow">Recent sessions</p>
 					<h2>{sessions.length}</h2>
 				</div>
 			</div>
 			<div className="recent-sessions-list">
 				{sessions.map((session) => (
 					<article className="recent-session-item" key={session.id}>
 						<div className="recent-session-info">
 							<span className="recent-session-name">
 								{session.display_name ||
 									session.tool_type_name ||
 									"Unnamed Session"}
 							</span>
 							<span className="muted">
 								{session.project_name} · {session.tool_type_name}
 							</span>
 						</div>
 						<button
 							className="ghost-button small"
 							type="button"
 							onClick={() => onOpen(session)}
 						>
 							Open
 						</button>
 					</article>
 				))}
 			</div>
 		</section>
 	);
 };
@@ -1,5 +0,0 @@
 export { DashboardSummary } from "./DashboardSummary";
 export { ActiveSessionsList } from "./ActiveSessionsList";
 export { ProjectsSection } from "./ProjectsSection";
 export { QuickCreateForm } from "./QuickCreateForm";
 export { RecentSessionsSection } from "./RecentSessionsSection";
@@ -1,130 +0,0 @@
 .commitDialog {
  background: var(--panel);
  border-radius: 14px;
  width: 100%;
  max-width: 600px;
  max-height: 90vh;
  overflow: auto;
  box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.1);
 }
 .dialogHeader {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 1rem 1.5rem;
  border-bottom: 1px solid var(--border);
 }
 .dialogHeader h3 {
  margin: 0;
  font-size: 1.1rem;
 }
 .dialogClose {
  background: none;
  border: none;
  font-size: 1.5rem;
  cursor: pointer;
  color: var(--muted);
  padding: 0;
  width: 2rem;
  height: 2rem;
  display: flex;
  align-items: center;
  justify-content: center;
  border-radius: 6px;
 }
 .dialogClose:hover {
  background: var(--bg);
  color: var(--ink);
 }
 .dialogBody {
  padding: 1.5rem;
 }
 .fileInfo {
  margin: 0 0 1rem;
  color: var(--muted);
 }
 .diffPreview {
  margin-bottom: 1.5rem;
 }
 .diffPreview h4 {
  margin: 0 0 0.75rem;
  font-size: 0.9rem;
  color: var(--muted);
 }
 .diffContent {
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 8px;
  overflow: auto;
  max-height: 300px;
  font-family: 'Fira Code', 'Monaco', 'Courier New', monospace;
  font-size: 13px;
 }
 .diffLine {
  display: flex;
  padding: 0.15rem 0.5rem;
  gap: 0.5rem;
 }
 .diffLineNumber {
  color: var(--muted);
  min-width: 2rem;
  text-align: right;
  user-select: none;
 }
 .diffMarker {
  width: 1rem;
  text-align: center;
  font-weight: bold;
 }
 .diffAdded {
  background: rgba(16, 185, 129, 0.1);
 }
 .diffAdded .diffMarker {
  color: #059669;
 }
 .diffRemoved {
  background: rgba(239, 68, 68, 0.1);
 }
 .diffRemoved .diffMarker {
  color: #dc2626;
 }
 .diffSame {
  background: transparent;
 }
 .diffLineContent {
  flex: 1;
 }
 .warningMessage {
  padding: 0.75rem;
  background: rgba(245, 158, 11, 0.1);
  color: #d97706;
  border-radius: 8px;
  margin-bottom: 1rem;
 }
 .dialogFooter {
  display: flex;
  justify-content: flex-end;
  gap: 0.75rem;
  padding: 1rem 1.5rem;
  border-top: 1px solid var(--border);
 }
@@ -1,84 +0,0 @@
 .commitPanel {
 	padding: 1rem;
 	border-top: 1px solid var(--border);
 	background: var(--panel);
 }
 .commitPanel h4 {
 	margin: 0 0 0.5rem 0;
 	font-size: 0.875rem;
 	font-weight: 600;
 }
 .fileList {
 	max-height: 150px;
 	overflow: auto;
 	margin-bottom: 0.75rem;
 }
 .fileItem {
 	display: flex;
 	align-items: center;
 	gap: 0.5rem;
 	padding: 0.25rem 0;
 	font-size: 0.8125rem;
 }
 .fileStatus {
 	font-weight: bold;
 	font-size: 0.75rem;
 	width: 1rem;
 	text-align: center;
 }
 .fileItem.modified .fileStatus {
 	color: #f59e0b;
 }
 .fileItem.added .fileStatus {
 	color: #10b981;
 }
 .fileItem.deleted .fileStatus {
 	color: #ef4444;
 }
 .fileItem.untracked .fileStatus {
 	color: #6b7280;
 }
 .commitForm {
 	display: flex;
 	flex-direction: column;
 	gap: 0.5rem;
 }
 .commitMessageInput {
 	width: 100%;
 	padding: 0.5rem;
 	border: 1px solid var(--border);
 	border-radius: 4px;
 	background: var(--bg);
 	color: var(--ink);
 	font-family: inherit;
 	font-size: 0.875rem;
 	resize: vertical;
 }
 .commitButton {
 	padding: 0.5rem 1rem;
 	background: var(--primary);
 	color: white;
 	border: none;
 	border-radius: 4px;
 	cursor: pointer;
 	font-size: 0.875rem;
 	font-weight: 500;
 }
 .commitButton:disabled {
 	opacity: 0.5;
 	cursor: not-allowed;
 }
 .commitError {
 	color: #ef4444;
 	font-size: 0.8125rem;
 }
@@ -1,103 +0,0 @@
 import { useState } from "react";
 import { commitChanges } from "../../../api/git-repositories";
 import styles from "./CommitPanel.module.css";
 interface CommitPanelProps {
 	projectId: string;
 	repoId: string;
 	modified: string[];
 	added: string[];
 	deleted: string[];
 	untracked: string[];
 	onCommit: () => void;
 }
 export const CommitPanel = ({
 	projectId,
 	repoId,
 	modified,
 	added,
 	deleted,
 	untracked,
 	onCommit,
 }: CommitPanelProps) => {
 	const [message, setMessage] = useState("");
 	const [loading, setLoading] = useState(false);
 	const [error, setError] = useState<string | null>(null);
 	const allFiles = [...modified, ...added, ...deleted, ...untracked];
 	const hasChanges = allFiles.length > 0;
 	const handleCommit = async () => {
 		if (!message.trim()) {
 			setError("Please enter a commit message");
 			return;
 		}
 		setLoading(true);
 		setError(null);
 		try {
 			await commitChanges(projectId, repoId, message);
 			setMessage("");
 			onCommit();
 		} catch {
 			setError("Commit failed. Please try again.");
 		} finally {
 			setLoading(false);
 		}
 	};
 	if (!hasChanges) return null;
 	return (
 		<div className={styles.commitPanel}>
 			<h4>Changes</h4>
 			<div className={styles.fileList}>
 				{modified.map((file) => (
 					<div key={file} className={`${styles.fileItem} modified`}>
 						<span className={styles.fileStatus}>M</span>
 						<span>{file}</span>
 					</div>
 				))}
 				{added.map((file) => (
 					<div key={file} className={`${styles.fileItem} added`}>
 						<span className={styles.fileStatus}>A</span>
 						<span>{file}</span>
 					</div>
 				))}
 				{deleted.map((file) => (
 					<div key={file} className={`${styles.fileItem} deleted`}>
 						<span className={styles.fileStatus}>D</span>
 						<span>{file}</span>
 					</div>
 				))}
 				{untracked.map((file) => (
 					<div key={file} className={`${styles.fileItem} untracked`}>
 						<span className={styles.fileStatus}>?</span>
 						<span>{file}</span>
 					</div>
 				))}
 			</div>
 			<div className={styles.commitForm}>
 				<textarea
 					placeholder="Commit message"
 					value={message}
 					onChange={(e) => setMessage(e.target.value)}
 					rows={2}
 					className={styles.commitMessageInput}
 				/>
 				{error && <div className={styles.commitError}>{error}</div>}
 				<button
 					onClick={handleCommit}
 					disabled={loading || !message.trim()}
 					className={styles.commitButton}
 					type="button"
 				>
 					{loading ? "Committing..." : "Commit"}
 				</button>
 			</div>
 		</div>
 	);
 };
@@ -1,63 +0,0 @@
 .fileTree {
  flex: 1;
  overflow: auto;
  padding: 0.5rem;
 }
 .treeEntry {
  display: block;
  width: 100%;
  padding: 0.375rem 0.5rem;
  border: none;
  background: none;
  color: var(--ink);
  text-align: left;
  cursor: pointer;
  border-radius: 4px;
  font-size: 0.875rem;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
 }
 .treeEntry:hover {
  background: var(--bg);
 }
 .treeDirectory {
  font-weight: 500;
 }
 .treeUp {
  color: var(--muted);
  font-style: italic;
 }
 .fileStatusIndicator {
  float: right;
  font-size: 0.75rem;
  font-weight: bold;
  padding: 0 0.375rem;
  border-radius: 3px;
  margin-left: 0.5rem;
 }
 .fileStatusIndicator.modified {
  color: #f59e0b;
  background: rgba(245, 158, 11, 0.1);
 }
 .fileStatusIndicator.added {
  color: #10b981;
  background: rgba(16, 185, 129, 0.1);
 }
 .fileStatusIndicator.deleted {
  color: #ef4444;
  background: rgba(239, 68, 68, 0.1);
 }
 .fileStatusIndicator.untracked {
  color: #6b7280;
  background: rgba(107, 114, 128, 0.1);
 }
@@ -1,62 +0,0 @@
 import { render, screen, waitFor } from "@testing-library/react";
 import { describe, it, expect, vi } from "vitest";
 import { MemoryRouter } from "react-router-dom";
 import { FileBrowser } from "./FileBrowser";
 // Mock apiClient
 vi.mock("../../../api/client", () => ({
 	apiClient: {
 		get: vi.fn(),
 	},
 }));
 import { apiClient } from "../../../api/client";
 describe("FileBrowser", () => {
 	it("renders loading state initially", () => {
 		render(
 			<MemoryRouter>
 				<FileBrowser projectId="p1" repoId="r1" gitStatus={null} />
 			</MemoryRouter>,
 		);
 		expect(screen.getByText(/loading files/i)).toBeInTheDocument();
 	});
 	it("renders file entries after loading", async () => {
 		const mockedGet = apiClient.get as ReturnType<typeof vi.fn>;
 		mockedGet.mockResolvedValueOnce({
 			data: {
 				entries: [
 					{ name: "src", type: "directory", path: "src" },
 					{ name: "README.md", type: "file", path: "README.md" },
 				],
 			},
 		});
 		render(
 			<MemoryRouter>
 				<FileBrowser projectId="p1" repoId="r1" gitStatus={null} />
 			</MemoryRouter>,
 		);
 		await waitFor(() => {
 			expect(screen.getByText("src")).toBeInTheDocument();
 		});
 		expect(screen.getByText("README.md")).toBeInTheDocument();
 	});
 	it("renders error state on failure", async () => {
 		const mockedGet = apiClient.get as ReturnType<typeof vi.fn>;
 		mockedGet.mockRejectedValueOnce(new Error("Network error"));
 		render(
 			<MemoryRouter>
 				<FileBrowser projectId="p1" repoId="r1" gitStatus={null} />
 			</MemoryRouter>,
 		);
 		await waitFor(() => {
 			expect(screen.getByText(/failed to load files/i)).toBeInTheDocument();
 		});
 	});
 });
@@ -1,150 +0,0 @@
 import { useCallback, useEffect, useState } from "react";
 import { useSearchParams } from "react-router-dom";
 import { Icon } from "../../ui/Icon";
 import { apiClient } from "../../../api/client";
 import type { GitStatus } from "../../../types/git-repository";
 interface FileTreeEntry {
 	name: string;
 	type: "file" | "directory";
 	path: string;
 	size?: number;
 	mode?: string;
 	last_commit?: {
 		hash: string;
 		message: string;
 		author: string;
 		date: string;
 	} | null;
 }
 interface FileBrowserProps {
 	projectId: string;
 	repoId: string;
 	gitStatus: GitStatus | null;
 }
 export const FileBrowser: React.FC<FileBrowserProps> = ({
 	projectId,
 	repoId,
 	gitStatus,
 }) => {
 	const [searchParams, setSearchParams] = useSearchParams();
 	const [entries, setEntries] = useState<FileTreeEntry[]>([]);
 	const [loading, setLoading] = useState(true);
 	const [error, setError] = useState<string | null>(null);
 	const branch = searchParams.get("branch") || "main";
 	const path = searchParams.get("path") || "";
 	const loadFiles = useCallback(async () => {
 		setLoading(true);
 		setError(null);
 		try {
 			const response = await apiClient.get(
 				`/projects/${projectId}/repositories/${repoId}/files`,
 				{
 					params: {
 						branch,
 						path,
 					},
 				},
 			);
 			setEntries(response.data.entries || []);
 		} catch {
 			setError("Failed to load files");
 		} finally {
 			setLoading(false);
 		}
 	}, [projectId, repoId, branch, path]);
 	useEffect(() => {
 		void loadFiles();
 	}, [loadFiles]);
 	// Listen for refresh events
 	useEffect(() => {
 		const handleRefresh = () => void loadFiles();
 		window.addEventListener("refresh-file-tree", handleRefresh);
 		return () => window.removeEventListener("refresh-file-tree", handleRefresh);
 	}, [loadFiles]);
 	const handleEntryClick = (entry: FileTreeEntry) => {
 		if (entry.type === "directory") {
 			const newParams = new URLSearchParams(searchParams);
 			newParams.set("path", entry.path);
 			setSearchParams(newParams);
 		} else {
 			const newParams = new URLSearchParams(searchParams);
 			newParams.set("file", entry.path);
 			setSearchParams(newParams);
 		}
 	};
 	const navigateUp = () => {
 		if (!path) return;
 		const parentPath = path.split("/").slice(0, -1).join("/");
 		const newParams = new URLSearchParams(searchParams);
 		if (parentPath) {
 			newParams.set("path", parentPath);
 		} else {
 			newParams.delete("path");
 		}
 		setSearchParams(newParams);
 	};
 	const getFileStatus = (filePath: string): string | null => {
 		if (!gitStatus) return null;
 		if (gitStatus.modified.includes(filePath)) return "modified";
 		if (gitStatus.added.includes(filePath)) return "added";
 		if (gitStatus.deleted.includes(filePath)) return "deleted";
 		if (gitStatus.untracked.includes(filePath)) return "untracked";
 		return null;
 	};
 	if (loading) return <p className="muted">Loading files...</p>;
 	if (error) return <p className="error-text">{error}</p>;
 	return (
 		<div className="file-tree">
 			{path && (
 				<button
 					className="tree-entry tree-up"
 					onClick={navigateUp}
 					type="button"
 				>
 					<Icon name="folder" size="sm" /> ..
 				</button>
 			)}
 			{entries.length === 0 && (
 				<p className="muted">No files in this repository yet.</p>
 			)}
 			{entries.map((entry) => {
 				const fileStatus =
 					entry.type === "file" ? getFileStatus(entry.path) : null;
 				return (
 					<button
 						key={entry.path}
 						className={`tree-entry ${entry.type === "directory" ? "tree-directory" : "tree-file"} ${fileStatus || ""}`}
 						onClick={() => handleEntryClick(entry)}
 						type="button"
 					>
 						<Icon
 							name={entry.type === "directory" ? "folder" : "file"}
 							size="sm"
 						/>{" "}
 						{entry.name}
 						{fileStatus && (
 							<span className={`file-status-indicator ${fileStatus}`}>
 								{fileStatus === "modified" && "M"}
 								{fileStatus === "added" && "A"}
 								{fileStatus === "deleted" && "D"}
 								{fileStatus === "untracked" && "?"}
 							</span>
 						)}
 					</button>
 				);
 			})}
 		</div>
 	);
 };
@@ -1,28 +0,0 @@
 .fileEditor {
  display: flex;
  flex-direction: column;
  height: 100%;
  overflow: hidden;
 }
 .fileEditorToolbar {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 0.75rem 1rem;
  background: var(--panel);
  border-bottom: 1px solid var(--border);
 }
 .fileActions {
  display: flex;
  gap: 0.5rem;
 }
 .fileEditorContent {
  flex: 1;
  overflow: hidden;
  background: var(--bg);
  display: flex;
  flex-direction: column;
 }
@@ -1,45 +0,0 @@
 .fileViewer {
 	background: var(--panel);
 	border: 1px solid var(--border);
 	border-radius: 8px;
 	overflow: hidden;
 }
 .fileViewerHeader {
 	padding: 0.75rem 1rem;
 	border-bottom: 1px solid var(--border);
 	background: var(--bg);
 }
 .fileBreadcrumbs {
 	font-size: 0.875rem;
 	font-family: monospace;
 }
 .breadcrumbSep {
 	color: var(--muted);
 	margin: 0 0.25rem;
 }
 .fileContent {
 	padding: 1rem;
 	overflow: auto;
 	max-height: calc(100vh - 200px);
 }
 .fileContent pre {
 	margin: 0;
 	font-family: "IBM Plex Mono", monospace;
 	font-size: 0.875rem;
 	line-height: 1.5;
 	white-space: pre-wrap;
 	word-wrap: break-word;
 }
 .fileViewerEmpty {
 	display: flex;
 	align-items: center;
 	justify-content: center;
 	height: 100%;
 	min-height: 300px;
 }
@@ -1,170 +0,0 @@
 .gitToolbar {
  display: flex;
  align-items: center;
  gap: 1rem;
  padding: 0.5rem 1.5rem;
  background: var(--bg);
  border-bottom: 1px solid var(--border);
  min-height: 48px;
 }
 .toolbarRow {
  display: flex;
  align-items: center;
  gap: 0.75rem;
  flex-wrap: wrap;
 }
 .toolbarGroup {
  display: flex;
  align-items: center;
  gap: 0.5rem;
 }
 .toolbarButton {
  display: flex;
  align-items: center;
  gap: 0.35rem;
  padding: 0.4rem 0.75rem;
  border: 1px solid var(--border);
  border-radius: 6px;
  background: var(--panel);
  color: var(--ink);
  font-size: 0.85rem;
  cursor: pointer;
  transition: all 0.2s;
  white-space: nowrap;
 }
 .toolbarButton:hover:not(:disabled) {
  background: var(--brand);
  color: white;
  border-color: var(--brand);
 }
 .toolbarButton:disabled {
  opacity: 0.5;
  cursor: not-allowed;
 }
 .toolbarButtonPrimary {
  display: flex;
  align-items: center;
  gap: 0.35rem;
  padding: 0.4rem 0.75rem;
  border: 1px solid var(--brand);
  border-radius: 6px;
  background: var(--brand);
  color: white;
  font-size: 0.85rem;
  cursor: pointer;
  transition: all 0.2s;
  white-space: nowrap;
 }
 .branchSelect {
  padding: 0.4rem 0.75rem;
  border: 1px solid var(--border);
  border-radius: 6px;
  background: var(--panel);
  color: var(--ink);
  font-size: 0.85rem;
  cursor: pointer;
  min-width: 140px;
 }
 .badge {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  min-width: 18px;
  height: 18px;
  padding: 0 4px;
  background: var(--brand);
  color: white;
  font-size: 0.7rem;
  font-weight: 600;
  border-radius: 999px;
 }
 .toolbarError {
  color: #ef4444;
  font-size: 0.85rem;
  padding: 0.25rem 0.5rem;
  background: rgba(239, 68, 68, 0.1);
  border-radius: 4px;
 }
 .toolbarInput {
  padding: 0.4rem 0.75rem;
  border: 1px solid var(--border);
  border-radius: 6px;
  background: var(--panel);
  color: var(--ink);
  font-size: 0.85rem;
 }
 .newBranchForm {
  padding: 0.75rem;
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 8px;
  margin-top: 0.5rem;
 }
 .statusSummary {
  gap: 0.75rem;
 }
 .statusBadge {
  display: inline-flex;
  align-items: center;
  gap: 0.25rem;
  padding: 0.2rem 0.5rem;
  border-radius: 4px;
  font-size: 0.8rem;
 }
 .statusBadgeModified {
  display: inline-flex;
  align-items: center;
  gap: 0.25rem;
  padding: 0.2rem 0.5rem;
  border-radius: 4px;
  font-size: 0.8rem;
  background: rgba(245, 158, 11, 0.1);
  color: #d97706;
 }
 .statusBadgeAdded {
  display: inline-flex;
  align-items: center;
  gap: 0.25rem;
  padding: 0.2rem 0.5rem;
  border-radius: 4px;
  font-size: 0.8rem;
  background: rgba(16, 185, 129, 0.1);
  color: #059669;
 }
 .statusBadgeDeleted {
  display: inline-flex;
  align-items: center;
  gap: 0.25rem;
  padding: 0.2rem 0.5rem;
  border-radius: 4px;
  font-size: 0.8rem;
  background: rgba(239, 68, 68, 0.1);
  color: #dc2626;
 }
 .statusBadgeUntracked {
  display: inline-flex;
  align-items: center;
  gap: 0.25rem;
  padding: 0.2rem 0.5rem;
  border-radius: 4px;
  font-size: 0.8rem;
  background: rgba(107, 114, 128, 0.1);
  color: #4b5563;
 }
@@ -1,45 +0,0 @@
 .mergeForm {
  display: flex;
  flex-direction: column;
  gap: 1rem;
 }
 .mergeForm .formField {
  display: flex;
  flex-direction: column;
  gap: 0.375rem;
 }
 .mergeForm label {
  font-size: 0.875rem;
  font-weight: 500;
 }
 .mergeForm select,
 .mergeForm input,
 .mergeForm textarea {
  padding: 0.5rem;
  border: 1px solid var(--border);
  border-radius: 4px;
  background: var(--bg);
  color: var(--ink);
  font-family: inherit;
  font-size: 0.875rem;
 }
 .mergeForm textarea {
  resize: vertical;
 }
 .inputDisabled {
  opacity: 0.6;
  cursor: not-allowed;
 }
 .successText {
  color: #10b981;
  font-size: 0.875rem;
  padding: 0.5rem;
  background: rgba(16, 185, 129, 0.1);
  border-radius: 4px;
 }
@@ -1,64 +0,0 @@
 import type { GitRepository } from "../../../types/git-repository";
 import type { GitStatus } from "../../../api/git-repositories";
 import type { ToolType } from "../../../types/tool-type";
 import { FileBrowser } from "./FileBrowser";
 import { CommitPanel } from "../git/CommitPanel";
 import { InstanceList } from "../session/InstanceList";
 interface WorkspaceSidebarProps {
 	projectId: string;
 	repoId: string;
 	repositories: GitRepository[];
 	gitStatus: GitStatus | null;
 	toolTypes: ToolType[];
 	onRepoChange: (repoId: string) => void;
 	onCommit: () => void;
 }
 export const WorkspaceSidebar = ({
 	projectId,
 	repoId,
 	repositories,
 	gitStatus,
 	toolTypes,
 	onRepoChange,
 	onCommit,
 }: WorkspaceSidebarProps) => {
 	return (
 		<aside className="workspace-sidebar">
 			<div className="sidebar-section">
 				<label className="form-field">
 					Repository
 					<select value={repoId} onChange={(e) => onRepoChange(e.target.value)}>
 						{repositories.map((repo) => (
 							<option key={repo.id} value={repo.id}>
 								{repo.name}
 							</option>
 						))}
 					</select>
 				</label>
 			</div>
 			<FileBrowser
 				projectId={projectId}
 				repoId={repoId}
 				gitStatus={gitStatus}
 			/>
 			{gitStatus && (
 				<CommitPanel
 					projectId={projectId}
 					repoId={repoId}
 					modified={gitStatus.modified}
 					added={gitStatus.added}
 					deleted={gitStatus.deleted}
 					untracked={gitStatus.untracked}
 					onCommit={onCommit}
 				/>
 			)}
 			<InstanceList
 				projectId={projectId}
 				repoId={repoId}
 				toolTypes={toolTypes}
 			/>
 		</aside>
 	);
 };
@@ -1,2 +0,0 @@
 export { FileBrowser } from "./FileBrowser";
 export { WorkspaceSidebar } from "./WorkspaceSidebar";
@@ -1,101 +0,0 @@
 import React, { useCallback, useEffect, useState } from "react";
 import { useParams } from "react-router-dom";
 import type { GitRepository } from "../../../types/git-repository";
 import { deleteRepository, listRepositories } from "../../../api/git-repositories";
 import { RepositoryCreateDialog } from "./RepositoryCreateDialog";
 import { Icon } from "../../ui/Icon";
 export const RepositoriesSettingsTab: React.FC = () => {
 	const { projectId } = useParams<{ projectId: string }>();
 	const [repositories, setRepositories] = useState<GitRepository[]>([]);
 	const [loading, setLoading] = useState(true);
 	const [showCreate, setShowCreate] = useState(false);
 	const [error, setError] = useState("");
 	const loadRepositories = useCallback(async () => {
 		if (!projectId) {
 			setLoading(false);
 			return;
 		}
 		setLoading(true);
 		try {
 			const data = await listRepositories(projectId);
 			setRepositories(data);
 		} catch {
 			setError("Failed to load repositories");
 		} finally {
 			setLoading(false);
 		}
 	}, [projectId]);
 	useEffect(() => {
 		void loadRepositories();
 	}, [loadRepositories]);
 	const handleDelete = async (repoId: string) => {
 		if (!projectId) return;
 		if (!window.confirm("Are you sure you want to delete this repository?"))
 			return;
 		try {
 			await deleteRepository(projectId, repoId);
 			setRepositories((current) => current.filter((r) => r.id !== repoId));
 		} catch {
 			setError("Failed to delete repository");
 		}
 	};
 	if (loading) return <div>Loading...</div>;
 	return (
 		<div className="repositories-settings-tab">
 			<div className="page-header">
 				<h2>Repositories</h2>
 				<button
 					className="primary-button"
 					onClick={() => setShowCreate(true)}
 					type="button"
 				>
 					<Icon name="add" size="sm" />
 					Add Repository
 				</button>
 			</div>
 			{error && <div className="error-message">{error}</div>}
 			<div className="repositories-list">
 				{repositories.length === 0 ? (
 					<p>No repositories yet.</p>
 				) : (
 					repositories.map((repo) => (
 						<div key={repo.id} className="repository-card">
 							<div className="repository-info">
 								<h3>{repo.name}</h3>
 								<p>{repo.remote_url}</p>
 								<span className="repo-type">
 									{repo.is_mirror ? "Mirror" : "Clone"}
 								</span>
 							</div>
 							<button
 								onClick={() => handleDelete(repo.id)}
 								className="btn-danger"
 							>
 								Delete
 							</button>
 						</div>
 					))
 				)}
 			</div>
 			{showCreate && (
 				<RepositoryCreateDialog
 					projectId={projectId!}
 					open={showCreate}
 					title="Add Repository"
 					onClose={() => setShowCreate(false)}
 					onCreated={loadRepositories}
 				/>
 			)}
 		</div>
 	);
 };
@@ -1,326 +0,0 @@
 import { useEffect, useRef, useState } from "react";
 import type {
 	GitRepositoryCreate,
 	URLParseResult,
 } from "../../../types/git-repository";
 import { createRepository, parseGitUrl } from "../../../api/git-repositories";
 import { Icon } from "../../ui/Icon";
 type CreateMode = "clone" | "blank";
 type UrlValidationStatus =
 	| "idle"
 	| "validating"
 	| "valid"
 	| "needs-parsing"
 	| "invalid";
 interface RepositoryCreateDialogProps {
 	projectId: string;
 	open: boolean;
 	title: string;
 	onClose: () => void;
 	onCreated: () => Promise<void> | void;
 }
 export const RepositoryCreateDialog = ({
 	projectId,
 	open,
 	title,
 	onClose,
 	onCreated,
 }: RepositoryCreateDialogProps) => {
 	const [createMode, setCreateMode] = useState<CreateMode>("clone");
 	const [formName, setFormName] = useState("");
 	const [owner, setOwner] = useState("");
 	const [repoName, setRepoName] = useState("");
 	const [advancedUrl, setAdvancedUrl] = useState("");
 	const [useAdvancedUrl, setUseAdvancedUrl] = useState(false);
 	const [formError, setFormError] = useState<string | null>(null);
 	const [urlValidation, setUrlValidation] = useState<{
 		status: UrlValidationStatus;
 		result: URLParseResult | null;
 	}>({ status: "idle", result: null });
 	const debounceTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
 	useEffect(() => {
 		if (!open && debounceTimer.current) {
 			clearTimeout(debounceTimer.current);
 			debounceTimer.current = null;
 		}
 	}, [open]);
 	useEffect(() => {
 		if (!open) return;
 		if (!useAdvancedUrl) {
 			setUrlValidation({ status: "idle", result: null });
 			return;
 		}
 		if (debounceTimer.current) {
 			clearTimeout(debounceTimer.current);
 		}
 		if (!advancedUrl.trim()) {
 			setUrlValidation({ status: "idle", result: null });
 			return;
 		}
 		setUrlValidation({ status: "validating", result: null });
 		debounceTimer.current = setTimeout(async () => {
 			try {
 				const result = await parseGitUrl(advancedUrl.trim());
 				if (result.is_valid_clone_url) {
 					setUrlValidation({ status: "valid", result });
 				} else if (result.needs_parsing) {
 					setUrlValidation({ status: "needs-parsing", result });
 				} else {
 					setUrlValidation({ status: "invalid", result });
 				}
 			} catch {
 				setUrlValidation({ status: "invalid", result: null });
 			}
 		}, 300);
 		return () => {
 			if (debounceTimer.current) {
 				clearTimeout(debounceTimer.current);
 			}
 		};
 	}, [advancedUrl, open, useAdvancedUrl]);
 	const resetForm = () => {
 		setCreateMode("clone");
 		setFormName("");
 		setOwner("");
 		setRepoName("");
 		setAdvancedUrl("");
 		setUseAdvancedUrl(false);
 		setFormError(null);
 		setUrlValidation({ status: "idle", result: null });
 	};
 	const handleClose = () => {
 		resetForm();
 		onClose();
 	};
 	const handleSubmit = async (event: React.FormEvent) => {
 		event.preventDefault();
 		setFormError(null);
 		if (!formName.trim()) {
 			setFormError("Repository name is required");
 			return;
 		}
 		try {
 			const input: GitRepositoryCreate = {
 				name: formName.trim(),
 				remote_url: undefined,
 			};
 			if (createMode === "clone") {
 				if (useAdvancedUrl) {
 					if (!advancedUrl.trim()) {
 						setFormError("Remote URL is required for advanced cloning");
 						return;
 					}
 					input.remote_url = advancedUrl.trim();
 				} else {
 					if (!owner.trim() || !repoName.trim()) {
 						setFormError("Owner and repository name are required");
 						return;
 					}
 					input.remote_url = `git@git.commumedia.org:${owner.trim()}/${repoName.trim()}.git`;
 				}
 			}
 			await createRepository(projectId, input);
 			handleClose();
 			await onCreated();
 		} catch (error: unknown) {
 			const response = error as { response?: { data?: { detail?: string } } };
 			const detail = response.response?.data?.detail;
 			setFormError(
 				typeof detail === "string" ? detail : "Failed to create repository",
 			);
 		}
 	};
 	const handleUseSuggestedUrl = () => {
 		if (urlValidation.result?.base_url) {
 			setAdvancedUrl(urlValidation.result.base_url);
 			setUrlValidation({ status: "idle", result: null });
 			setFormError(null);
 		}
 	};
 	const getUrlInputClass = () => {
 		switch (urlValidation.status) {
 			case "valid":
 				return "valid-url";
 			case "needs-parsing":
 				return "needs-parsing-url";
 			case "invalid":
 				return "invalid-url";
 			default:
 				return "";
 		}
 	};
 	if (!open) return null;
 	return (
 		<div className="dialog-overlay" role="dialog" aria-modal="true">
 			<div className="dialog">
 				<h3>{title}</h3>
 				<p className="muted">
 					Clone an existing repository from git.commumedia.org, or create a
 					blank bare repo here.
 				</p>
 				<form onSubmit={handleSubmit} className="stack">
 					<div className="form-field">
 						<label>
 							<input
 								type="radio"
 								name="repository-mode"
 								checked={createMode === "clone"}
 								onChange={() => setCreateMode("clone")}
 							/>
 							Clone existing repository
 						</label>
 						<label>
 							<input
 								type="radio"
 								name="repository-mode"
 								checked={createMode === "blank"}
 								onChange={() => setCreateMode("blank")}
 							/>
 							Create blank repository
 						</label>
 					</div>
 					<label className="form-field">
 						Repository name
 						<input
 							type="text"
 							value={formName}
 							onChange={(event) => setFormName(event.target.value)}
 							placeholder="repository-name"
 						/>
 					</label>
 					{createMode === "clone" && !useAdvancedUrl && (
 						<>
 							<label className="form-field">
 								Owner
 								<input
 									type="text"
 									value={owner}
 									onChange={(event) => setOwner(event.target.value)}
 									placeholder="owner"
 								/>
 							</label>
 							<label className="form-field">
 								Repository
 								<input
 									type="text"
 									value={repoName}
 									onChange={(event) => setRepoName(event.target.value)}
 									placeholder="repo-name"
 								/>
 							</label>
 							<p className="muted">
 								SSH target: git@git.commumedia.org:{owner || "owner"}/
 								{repoName || "repo"}.git
 							</p>
 							<button
 								type="button"
 								className="secondary-button small"
 								onClick={() => setUseAdvancedUrl(true)}
 							>
 								Use full URL instead
 							</button>
 						</>
 					)}
 					{createMode === "clone" && useAdvancedUrl && (
 						<label className="form-field">
 							Remote URL
 							<input
 								type="text"
 								value={advancedUrl}
 								onChange={(event) => setAdvancedUrl(event.target.value)}
 								placeholder="https://github.com/user/repo.git"
 								className={getUrlInputClass()}
 							/>
 							{urlValidation.status === "validating" && (
 								<span className="validation-status validating">
 									Validating...
 								</span>
 							)}
 							{urlValidation.status === "valid" && (
 								<span className="validation-status valid">
 									<Icon name="success" size="sm" /> Valid git URL
 								</span>
 							)}
 							{urlValidation.status === "needs-parsing" &&
 								urlValidation.result && (
 									<div className="url-suggestion">
 										<span className="validation-status warning">
 											<Icon name="warning" size="sm" /> This looks like a
 											browser URL
 										</span>
 										<div className="suggestion-actions">
 											<span className="suggested-url">
 												Suggested: {urlValidation.result.base_url}
 											</span>
 											<button
 												type="button"
 												className="secondary-button small"
 												onClick={handleUseSuggestedUrl}
 											>
 												Use Suggested
 											</button>
 										</div>
 									</div>
 								)}
 							{urlValidation.status === "invalid" && (
 								<span className="validation-status invalid">
 									<Icon name="error" size="sm" /> Invalid URL
 								</span>
 							)}
 							<button
 								type="button"
 								className="secondary-button small"
 								onClick={() => setUseAdvancedUrl(false)}
 							>
 								Use owner/repo instead
 							</button>
 						</label>
 					)}
 					{formError && (
 						<div className="error-message">
 							<p className="error-text">{formError}</p>
 						</div>
 					)}
 					<div className="dialog-actions">
 						<button
 							className="secondary-button"
 							onClick={handleClose}
 							type="button"
 						>
 							<Icon name="cancel" size="sm" />
 							Cancel
 						</button>
 						<button className="primary-button" type="submit">
 							<Icon name="add" size="sm" />
 							{createMode === "clone"
 								? "Clone Repository"
 								: "Create Blank Repository"}
 						</button>
 					</div>
 				</form>
 			</div>
 		</div>
 	);
 };
@@ -1,147 +0,0 @@
 import { render, screen, fireEvent, waitFor } from "@testing-library/react";
 import { describe, it, expect, vi } from "vitest";
 import { CreateSessionForm } from "./CreateSessionForm";
 import type { Project } from "@/types/project";
 import type { ToolType } from "@/types/tool-type";
 vi.mock("@/api/git_repositories", () => ({
 	listRepositories: vi.fn(),
 }));
 vi.mock("@/api/sessions", () => ({
 	createInstance: vi.fn(),
 	startInstance: vi.fn(),
 }));
 vi.mock("@/api/settings", () => ({
 	updateUserConfig: vi.fn(),
 }));
 import { listRepositories } from "@/api/git-repositories";
 import { createInstance } from "@/api/sessions";
 const mockProjects = [
 	{
 		id: "p1",
 		name: "Project One",
 		description: null,
 		owner_id: "u1",
 		default_ssh_key_id: null,
 	},
 	{
 		id: "p2",
 		name: "Project Two",
 		description: null,
 		owner_id: "u1",
 		default_ssh_key_id: null,
 	},
 ] as Project[];
 const mockToolTypes = [
 	{
 		id: "t1",
 		name: "vscode",
 		display_name: "VS Code",
 		description: null,
 		category: "editor",
 		interfaces: ["web"],
 		default_port: 8443,
 		definition_type: "compose",
 		compose_template: "",
 		dockerfile_template: null,
 		readiness_probe: null,
 		required_variables: [],
 		is_builtin: true,
 		build_context: null,
 		created_by_id: "u1",
 		created_at: "",
 		updated_at: "",
 	},
 	{
 		id: "t2",
 		name: "terminal",
 		display_name: "Terminal",
 		description: null,
 		category: "shell",
 		interfaces: ["terminal"],
 		default_port: 22,
 		definition_type: "dockerfile",
 		compose_template: null,
 		dockerfile_template: "",
 		readiness_probe: null,
 		required_variables: [],
 		is_builtin: true,
 		build_context: null,
 		created_by_id: "u1",
 		created_at: "",
 		updated_at: "",
 	},
 ] as ToolType[];
 describe("CreateSessionForm", () => {
 	it("renders form with create button", () => {
 		render(
 			<CreateSessionForm
 				projects={mockProjects}
 				toolTypes={mockToolTypes}
 				onCreated={vi.fn()}
 			/>,
 		);
 		expect(screen.getByText("Create New Session")).toBeInTheDocument();
 		expect(screen.getByText("Create Session")).toBeInTheDocument();
 	});
 	it("shows validation error when fields are missing", async () => {
 		render(
 			<CreateSessionForm
 				projects={mockProjects}
 				toolTypes={mockToolTypes}
 				onCreated={vi.fn()}
 			/>,
 		);
 		const { container } = render(
 			<CreateSessionForm
 				projects={mockProjects}
 				toolTypes={mockToolTypes}
 				onCreated={vi.fn()}
 			/>,
 		);
 		const submitBtn = container.querySelector(
 			'button[type="submit"]',
 		) as HTMLButtonElement;
 		fireEvent.click(submitBtn);
 		await waitFor(() => {
 			expect(
 				screen.getByText(/project, repository, and tool type are required/i),
 			).toBeInTheDocument();
 		});
 		expect(createInstance).not.toHaveBeenCalled();
 	});
 	it("loads repositories when project selected", async () => {
 		const mockedList = listRepositories as ReturnType<typeof vi.fn>;
 		mockedList.mockResolvedValueOnce([{ id: "r1", name: "repo-one" }]);
 		const { container } = render(
 			<CreateSessionForm
 				projects={mockProjects}
 				toolTypes={mockToolTypes}
 				onCreated={vi.fn()}
 			/>,
 		);
 		const projectSelect = container.querySelector(
 			"select",
 		) as HTMLSelectElement;
 		fireEvent.change(projectSelect, { target: { value: "p1" } });
 		await waitFor(() => {
 			expect(listRepositories).toHaveBeenCalledWith("p1");
 		});
 	});
 });
@@ -1,167 +0,0 @@
 import React, { useEffect, useState } from "react";
 import { listRepositories } from "@/api/git-repositories";
 import { createInstance, startInstance } from "@/api/sessions";
 import { updateUserConfig } from "@/api/settings";
 import { Icon } from "@/components/ui/Icon";
 import type { Project } from "@/types/project";
 import type { GitRepository } from "@/types/git-repository";
 import type { ToolType } from "@/types/tool-type";
 interface CreateSessionFormProps {
 	projects: Project[];
 	toolTypes: ToolType[];
 	onCreated: () => void;
 }
 type CreateStatus = "idle" | "creating" | "error";
 export const CreateSessionForm: React.FC<CreateSessionFormProps> = ({
 	projects,
 	toolTypes,
 	onCreated,
 }) => {
 	const [selectedProject, setSelectedProject] = useState("");
 	const [selectedRepo, setSelectedRepo] = useState("");
 	const [selectedToolType, setSelectedToolType] = useState("");
 	const [displayName, setDisplayName] = useState("");
 	const [createStatus, setCreateStatus] = useState<CreateStatus>("idle");
 	const [createError, setCreateError] = useState<string | null>(null);
 	const [repositories, setRepositories] = useState<GitRepository[]>([]);
 	useEffect(() => {
 		if (!selectedProject) {
 			setRepositories([]);
 			return;
 		}
 		const loadRepos = async () => {
 			try {
 				const data = await listRepositories(selectedProject);
 				setRepositories(data);
 			} catch {
 				setRepositories([]);
 			}
 		};
 		void loadRepos();
 	}, [selectedProject]);
 	const handleCreate = async (e: React.FormEvent) => {
 		e.preventDefault();
 		setCreateError(null);
 		if (!selectedProject || !selectedRepo || !selectedToolType) {
 			setCreateError("Project, repository, and tool type are required");
 			return;
 		}
 		setCreateStatus("creating");
 		try {
 			const instance = await createInstance(
 				selectedProject,
 				selectedRepo,
 				selectedToolType,
 				displayName || undefined,
 			);
 			await startInstance(selectedProject, selectedRepo, instance.id);
 			await updateUserConfig({ last_session_id: instance.id });
 			setCreateStatus("idle");
 			setSelectedProject("");
 			setSelectedRepo("");
 			setSelectedToolType("");
 			setDisplayName("");
 			onCreated();
 		} catch {
 			setCreateStatus("error");
 			setCreateError("Failed to create session");
 		}
 	};
 	return (
 		<div className="create-session-section">
 			<h2>Create New Session</h2>
 			<form onSubmit={handleCreate} className="card stack create-session-form">
 				<div className="form-row">
 					<label className="form-field">
 						Project
 						<select
 							value={selectedProject}
 							onChange={(e) => {
 								setSelectedProject(e.target.value);
 								setSelectedRepo("");
 							}}
 						>
 							<option value="">Select project...</option>
 							{projects.map((p) => (
 								<option key={p.id} value={p.id}>
 									{p.name}
 								</option>
 							))}
 						</select>
 					</label>
 					<label className="form-field">
 						Repository
 						<select
 							value={selectedRepo}
 							onChange={(e) => setSelectedRepo(e.target.value)}
 							disabled={!selectedProject}
 						>
 							<option value="">Select repository...</option>
 							{repositories.map((r) => (
 								<option key={r.id} value={r.id}>
 									{r.name}
 								</option>
 							))}
 						</select>
 					</label>
 					<label className="form-field">
 						Tool Type
 						<select
 							value={selectedToolType}
 							onChange={(e) => setSelectedToolType(e.target.value)}
 						>
 							<option value="">Select tool...</option>
 							{toolTypes.map((t) => (
 								<option key={t.id} value={t.id}>
 									{t.display_name}
 								</option>
 							))}
 						</select>
 					</label>
 				</div>
 				<label className="form-field">
 					Display Name (optional)
 					<input
 						type="text"
 						value={displayName}
 						onChange={(e) => setDisplayName(e.target.value)}
 						placeholder="My Development Environment"
 					/>
 				</label>
 				{createError && <p className="error-text">{createError}</p>}
 				<div className="form-actions">
 					<button
 						className="primary-button"
 						type="submit"
 						disabled={createStatus === "creating"}
 					>
 						{createStatus === "creating" ? (
 							<>
 								<Icon name="loading" size="sm" />
 								Creating...
 							</>
 						) : (
 							<>
 								<Icon name="add" size="sm" />
 								Create Session
 							</>
 						)}
 					</button>
 				</div>
 			</form>
 		</div>
 	);
 };
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`export { FileBrowser } from "./FileBrowser";`
			`export { WorkspaceSidebar } from "./WorkspaceSidebar";`