@@ -47,6 +47,11 @@ export const CLOUD_CODEX_MODELS: readonly CloudCliModel[] = [
     label: 'GPT-6-Sol',
     tagline: 'Reliable agentic workhorse for everyday tasks',
   },
+  {
+    id: 'gpt-6.1-sol',
+    label: 'GPT-6.1-Sol',
+    tagline: 'Latest agentic workhorse for everyday tasks',
+  },
   {
     id: 'gpt-6-astra',
     label: 'GPT-6-Astra',
 
@@ -5,6 +5,27 @@ export const CLOUD_ARCHIVE_BYTES = 4 * 1024 ** 3
 export const CLOUD_EXPANDED_BYTES = 16 * 1024 ** 3
 export const CLOUD_SOURCE_FILES = 200_000
 export const CLOUD_UPLOAD_PART_BYTES = 8 * 1024 ** 2
+// `GET projects/:id/git-bases?archive=…`: the client packs a Git upload's base bundle before its
+// files. Desktop 0.0.174 packed it after them and hung on any real project, so the API serves
+// the bases (which turn the bundle on) only to clients that send this.
+export const CLOUD_GIT_BASES_ARCHIVE = '2'
+// `?archive=` of a client that uploads Git objects instead of history bundles: a packfile of only
+// what Cloud lacks, registered as a project pack (POST projects/:id/packs), and a zstd overlay of
+// the working tree's differences. It is also told the bases those packs made shallow, which a
+// bundle client must never build on.
+export const CLOUD_GIT_BASES_PACKED = '3'
+/**
+ * What a direct (streamed) source upload holds, which fixes its object key's suffix: a zstd tar
+ * of files laid over a chat's base, or a Git packfile. Proxied uploads are always `.tar.gz`.
+ */
+export const cloudSourceKindSchema = z.enum(['overlay', 'pack'])
+export type CloudSourceKind = z.infer<typeof cloudSourceKindSchema>
+export const CLOUD_SOURCE_SUFFIX: Record<CloudSourceKind, string> = {
+  overlay: '.tar.zst',
+  pack: '.pack',
+}
+/** A project pack's commits, HEAD included; more unpushed commits than this go up as HEAD alone. */
+export const CLOUD_PACK_MAX_COMMITS = 500
 
 /**
  * What a size refusal tells the user to DO.
 
@@ -0,0 +1,22 @@
+/** File changes returned by the Cloud worktree and local Desktop Git readers. */
+export type ChangesScope = 'all' | 'uncommitted'
+export interface ChangedFile {
+  path: string
+  status: 'added' | 'modified' | 'deleted'
+  modifiedAt: number | null
+  adds: number | null
+  dels: number | null
+  binary: boolean
+  untracked: boolean
+}
+export interface FileDiffResult {
+  patch?: string
+  binary?: boolean
+  tooLarge?: boolean
+}
+export interface CloudChanges {
+  scope: ChangesScope
+  branch: string | null
+  files: ChangedFile[]
+  totals: { files: number; adds: number; dels: number }
+}
@@ -0,0 +1,41 @@
+import { expect, test } from 'bun:test'
+import { FILE_DOWNLOAD_CHUNK_BYTES as CHUNK, fileDownloadResponse } from './file-download'
+
+test('download response preserves binary bytes, filename and size beyond preview limits', async () => {
+  const data = new Uint8Array(CHUNK * 5 + 7).map((_, i) => i % 256)
+  const offsets: number[] = []
+  let closed = 0
+  const response = await fileDownloadResponse('dir/résumé "x".bin', async offset => {
+    offsets.push(offset)
+    return { data: data.slice(offset, offset + CHUNK), size: data.length, revision: 'stable' }
+  }, { close: async () => { closed++ } })
+  expect(response.headers.get('content-type')).toBe('application/octet-stream')
+  expect(response.headers.get('content-disposition')).toContain('r%C3%A9sum%C3%A9%20%22x%22.bin')
+  expect(new Uint8Array(await response.arrayBuffer())).toEqual(data)
+  expect(offsets).toEqual([0, CHUNK, CHUNK * 2, CHUNK * 3, CHUNK * 4, CHUNK * 5])
+  expect(closed).toBe(1)
+})
+test('file replacement and truncated chunks abort the response instead of completing a partial download', async () => {
+  for (const changed of ['revision', 'size', 'short']) {
+    let closed = 0
+    const response = await fileDownloadResponse('file', async offset => ({
+      data: new Uint8Array(offset && changed === 'short' ? 1 : CHUNK),
+      size: offset && changed === 'size' ? CHUNK * 3 : CHUNK * 2,
+      revision: offset && changed === 'revision' ? 'changed' : 'first',
+    }), { close: async () => { closed++ } })
+    await expect(response.arrayBuffer()).rejects.toThrow('changed')
+    expect(closed).toBe(1)
+  }
+})
+test('cancellation closes idle reads and initial failures close before returning headers', async () => {
+  let closed = 0
+  const abort = new AbortController()
+  const response = await fileDownloadResponse('file', async () => ({ data: new Uint8Array(CHUNK), size: CHUNK * 2, revision: 'a' }),
+    { signal: abort.signal, close: async () => { closed++ } })
+  abort.abort(new Error('cancelled'))
+  // Bun 1.3 throws synchronously for an already-errored Response body.
+  await expect((async () => response.arrayBuffer())()).rejects.toThrow('cancelled')
+  expect(closed).toBe(1)
+  await expect(fileDownloadResponse('file', async () => { throw new Error('missing') }, { close: async () => { closed++ } })).rejects.toThrow('missing')
+  expect(closed).toBe(2)
+})
@@ -0,0 +1,75 @@
+/** Bounded binary reads shared by Desktop and Cloud; previews have separate limits. */
+export const FILE_DOWNLOAD_CHUNK_BYTES = 256 * 1024
+export interface FileDownloadChunk {
+  data: Uint8Array
+  size: number
+  revision: string
+}
+
+/** Fetch the first chunk before sending headers so missing files remain HTTP errors.
+ * Later failures abort the body: a partial download must never look successful. */
+export async function fileDownloadResponse(
+  path: string,
+  read: (offset: number) => Promise<FileDownloadChunk>,
+  options: { signal?: AbortSignal; close?: () => Promise<void> } = {},
+): Promise<Response> {
+  let closed = false
+  let onAbort: (() => void) | undefined
+  const close = async () => {
+    if (closed) return
+    closed = true
+    if (onAbort) options.signal?.removeEventListener('abort', onAbort)
+    await options.close?.()
+  }
+  let first: FileDownloadChunk
+  try {
+    options.signal?.throwIfAborted()
+    first = await read(0)
+    options.signal?.throwIfAborted()
+    if (!Number.isSafeInteger(first.size) || first.size < 0) throw new Error('Invalid download size')
+  } catch (error) {
+    await close()
+    throw error
+  }
+  let offset = 0
+  let initial: FileDownloadChunk | undefined = first
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      onAbort = () => {
+        controller.error(options.signal?.reason ?? new Error('Download cancelled'))
+        void close().catch(() => {})
+      }
+      options.signal?.addEventListener('abort', onAbort, { once: true })
+    },
+    async pull(controller) {
+      try {
+        options.signal?.throwIfAborted()
+        const chunk = initial ?? await read(offset)
+        initial = undefined
+        if (closed) return
+        options.signal?.throwIfAborted()
+        if (chunk.size !== first.size || chunk.revision !== first.revision ||
+            chunk.data.length !== Math.min(FILE_DOWNLOAD_CHUNK_BYTES, first.size - offset))
+          throw new Error('The file changed during download. Please try again.')
+        offset += chunk.data.length
+        if (chunk.data.length) controller.enqueue(chunk.data)
+        if (offset === first.size) {
+          await close()
+          controller.close()
+        }
+      } catch (error) {
+        await close()
+        controller.error(error)
+      }
+    },
+    cancel: close,
+  })
+  const filename = path.split(/[\\/]/).pop() || 'download'
+  return new Response(body, { headers: {
+    'Content-Type': 'application/octet-stream',
+    'Content-Length': String(first.size),
+    'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent(filename).replace(/['()*]/g, char => '%' + char.charCodeAt(0).toString(16))}`,
+    'Cache-Control': 'private, no-store, no-transform',
+    'X-Content-Type-Options': 'nosniff',
+  } })
+}
@@ -36,6 +36,13 @@ export const handbackRequestSchema = z
   .strict()
 export type HandbackRequest = z.infer<typeof handbackRequestSchema>
 
+/** Sent only after Desktop has committed the local landing. The timestamp identifies this move,
+ * so a delayed acknowledgement cannot reclaim a later Cloud workspace. */
+export const handbackCompleteSchema = handbackRequestSchema.extend({
+  handedBackAt: z.iso.datetime({ offset: true }),
+})
+export type HandbackCompleteRequest = z.infer<typeof handbackCompleteSchema>
+
 export interface HandbackResponse {
   workspaceId: string
   /** ISO time the chat left Cloud. Repeating the same handback returns the original time. */
@@ -71,7 +78,7 @@ export const CLOUD_EXPORT_BUNDLE_REF = 'HEAD'
 
 const commitSchema = z.string().regex(/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/)
 
-export const cloudExportMetaSchema = z
+const cloudExportV2Schema = z
   .object({
     version: z.literal(2),
     /** The commit the worktree started from (its marker), or null for a chat initialized before it was recorded. */
@@ -86,4 +93,22 @@ export const cloudExportMetaSchema = z
     deleted: z.array(z.string().max(4096)).max(200_000),
   })
   .strict()
+/** V3 sends Git objects once plus only working files whose bytes differ from HEAD.
+ * `have` is a complete commit graph verified by the receiver; unknown bases send a full pack.
+ * `files` is the complete eligible working-file inventory, for plain-folder reconstruction.
+ * `shallow` preserves any history boundary already present in Cloud (never invents one).
+ */
+export const cloudExportV3Schema = cloudExportV2Schema.extend({
+  version: z.literal(3),
+  bundle: z.literal(false),
+  pack: z.boolean(),
+  have: commitSchema.nullable(),
+  shallow: z.array(commitSchema).max(200_000),
+  files: z.array(z.string().max(4096)).max(200_000),
+}).strict()
+export const cloudExportMetaSchema = z.union([cloudExportV2Schema, cloudExportV3Schema])
 export type CloudExportMeta = z.infer<typeof cloudExportMetaSchema>
+
+/** Archived chats resume through Desktop's existing local landing and Cloud upload. */
+export const ARCHIVED_CHAT_RESTORE_ERROR =
+  'This chat’s Cloud workspace was archived. Restore it in Freebuff Desktop to continue.'
@@ -33,6 +33,8 @@ export type CloudHistoryChat = {
   archivedAt: string | null
   /** Continue locally (COD-878): when the chat moved to a computer, or null. Absent from older servers. */
   handedBackAt?: string | null
+  /** Archived Cloud files must land on this computer before another run. */
+  localRestoreRequired?: boolean
   metadataRevision: number
   phase: string
   updatedAt: string
 
@@ -9,7 +9,7 @@ export const PLACEMENT_GUIDANCE =
   'Cloud suits long or unattended work (the user wants to step away), several things in parallel, heavy or risky installs, and deploying a site. ' +
   "The user's computer suits work that needs it: its hardware, simulators or devices, the user's Docker images, VPN or localhost services, CLI sign-ins and browser or MCP tools only that computer has, files outside the project, and quick edit-and-check loops against something already running there. " +
   "The user's explicit wording always wins. If unsure, stay. At most one move per user message, and never back unless the user asks. " +
-  'After calling it, end your turn with one short line saying where the chat is going and why; the chat continues there on its own.'
+  'Calling it switches the runtime at this tool boundary. Continue the same response from the tool result in the destination; do not end your turn or ask the user to continue. Do not announce or summarize the runtime change; simply carry on with the task.'
 
 /** The run event a Cloud run writes when its agent asks to continue on the user's computer. */
 export const HANDOFF_REQUEST_EVENT = 'handoff_request'
@@ -0,0 +1,17 @@
+/** Stable product messages, also used when Desktop imports Cloud history. */
+export const CLOUD_RESOURCE_MESSAGE =
+  'Your cloud environment has reached its resource limit. Open this chat in the Desktop app to continue locally.'
+export const CLOUD_RESOURCE_PENDING =
+  'Your cloud environment has reached its resource limit. Your files are being saved for recovery. Open this chat in the Desktop app to continue locally.'
+export const CLOUD_RESOURCE_MOVE_REASON =
+  'The cloud environment is running low on resources. Continue the same task locally, preserving completed work and checking any interrupted command before retrying it.'
+export const CLOUD_RESOURCE_EVENT = 'resource_limit'
+export type CloudResourceKind =
+  | 'disk'
+  | 'memory'
+  | 'cpu'
+  | 'processes'
+  | 'files'
+  | 'time'
+export const isCloudResourceMessage = (message: string | null | undefined) =>
+  message === CLOUD_RESOURCE_MESSAGE || message === CLOUD_RESOURCE_PENDING