@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// Build levelcode-ai for the browser: ONE file the web extension host can evaluate, plus the
+// files the manifest points at. The desktop extension stays plain JS with no build step; this
+// bundler only exists for the browser edition and writes nothing into extensions/.
+//
+//   node web/ai-extension/build.mjs --out <dir> --vscode <Code-OSS checkout> [--minify]
+//
+// Output (<dir>/levelcode-ai):  package.json (+ "browser"), extension.web.js, media/, README.md
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO = path.resolve(HERE, '..', '..');
+const SRC = path.join(REPO, 'extensions', 'levelcode-ai');
+
+const args = Object.fromEntries(process.argv.slice(2).reduce((a, v, i, all) => {
+	if (v.startsWith('--')) { a.push([v.slice(2), all[i + 1] && !all[i + 1].startsWith('--') ? all[i + 1] : 'true']); }
+	return a;
+}, []));
+const outRoot = path.resolve(args.out || path.join(REPO, 'dist-web', 'extensions'));
+const vscodeDir = path.resolve(args.vscode || path.join(REPO, 'vscode'));
+const minify = args.minify === 'true';
+
+/** Find esbuild and the `buffer` package in the Code-OSS checkout, which already depends on both. */
+function locate(name, bases) {
+	for (const b of bases) {
+		try { return createRequire(path.join(b, 'noop.js')).resolve(name); } catch { /* next */ }
+	}
+	return null;
+}
+const esbuildEntry = locate('esbuild', [path.join(vscodeDir, 'build'), path.join(vscodeDir, 'extensions'), vscodeDir, REPO]);
+if (!esbuildEntry) { console.error('esbuild not found under ' + vscodeDir + ' (run scripts/bootstrap.sh first)'); process.exit(2); }
+const esbuild = await import(esbuildEntry);
+const nodePaths = [path.join(vscodeDir, 'node_modules'), path.join(vscodeDir, 'build', 'node_modules')].filter((p) => fs.existsSync(p));
+if (!nodePaths.some((p) => fs.existsSync(path.join(p, 'buffer')))) { console.error('the "buffer" package is missing from ' + vscodeDir + '/node_modules'); process.exit(2); }
+
+const outDir = path.join(outRoot, 'levelcode-ai');
+fs.rmSync(outDir, { recursive: true, force: true });
+fs.mkdirSync(outDir, { recursive: true });
+
+/* ----- the extension's own files, embedded so synchronous reads keep working ------------------ */
+const TEXT = new Set(['.html', '.svg', '.md', '.json', '.css', '.js', '.txt']);
+function collect(rel, filter) {
+	const out = {};
+	const walk = (dir) => {
+		for (const e of fs.readdirSync(path.join(SRC, dir), { withFileTypes: true })) {
+			const r = path.posix.join(dir, e.name);
+			if (e.isDirectory()) { walk(r); continue; }
+			if (filter && !filter(r)) { continue; }
+			const buf = fs.readFileSync(path.join(SRC, r));
+			out[r] = TEXT.has(path.extname(r)) ? buf.toString('utf8') : { base64: buf.toString('base64') };
+		}
+	};
+	if (fs.existsSync(path.join(SRC, rel))) { walk(rel); }
+	return out;
+}
+const assets = Object.assign({},
+	collect('media'),
+	collect('skills'),
+	collect('diagram', (r) => r.endsWith('.js')),
+);
+const generated = path.join(HERE, 'assets.generated.js');
+fs.writeFileSync(generated, '// GENERATED by build.mjs — do not edit, do not commit.\nmodule.exports = ' + JSON.stringify(assets) + ';\n');
+
+/* ----- __dirname has no meaning in a bundle: point it at the mounted copy -------------------- */
+const dirnamePlugin = {
+	name: 'levelcode-dirname',
+	setup(b) {
+		b.onLoad({ filter: /extensions[\\/]levelcode-ai[\\/].*\.js$/ }, (a) => {
+			let text = fs.readFileSync(a.path, 'utf8');
+			if (!/\b__dirname\b/.test(text)) { return null; }
+			const rel = path.relative(SRC, path.dirname(a.path)).split(path.sep).join('/');
+			text = text.replace(/\b__dirname\b/g, `(globalThis.__lcExtPath + ${JSON.stringify(rel ? '/' + rel : '')})`);
+			return { contents: text, loader: 'js' };
+		});
+	},
+};
+
+const shim = (n) => path.join(HERE, 'shims', n + '.js');
+await esbuild.build({
+	entryPoints: [path.join(HERE, 'entry.js')],
+	outfile: path.join(outDir, 'extension.web.js'),
+	bundle: true,
+	platform: 'browser',
+	format: 'cjs',
+	target: 'es2022',
+	external: ['vscode'],
+	alias: {
+		fs: shim('fs'), 'node:fs': shim('fs'),
+		path: shim('path'), 'node:path': shim('path'),
+		os: shim('os'), 'node:os': shim('os'),
+		crypto: shim('crypto'), 'node:crypto': shim('crypto'),
+		child_process: shim('child_process'), 'node:child_process': shim('child_process'),
+	},
+	inject: [path.join(HERE, 'inject.js')],
+	define: { global: 'globalThis' },
+	nodePaths,
+	plugins: [dirnamePlugin],
+	minify,
+	sourcemap: minify ? false : 'inline',
+	legalComments: 'none',
+	logLevel: 'info',
+});
+fs.rmSync(generated, { force: true });
+
+/* ----- manifest + the files it refers to ---------------------------------------------------- */
+const pkg = JSON.parse(fs.readFileSync(path.join(SRC, 'package.json'), 'utf8'));
+pkg.browser = './extension.web.js';
+fs.writeFileSync(path.join(outDir, 'package.json'), JSON.stringify(pkg, null, '\t') + '\n');
+for (const f of ['README.md', 'package.nls.json']) { if (fs.existsSync(path.join(SRC, f))) { fs.copyFileSync(path.join(SRC, f), path.join(outDir, f)); } }
+fs.cpSync(path.join(SRC, 'media'), path.join(outDir, 'media'), { recursive: true });
+
+const size = fs.statSync(path.join(outDir, 'extension.web.js')).size;
+console.log(`levelcode-ai (browser) -> ${outDir}  extension.web.js ${(size / 1024).toFixed(0)} KB, ${Object.keys(assets).length} embedded files`);
@@ -0,0 +1,26 @@
+// Entry of the browser build of levelcode-ai. The extension itself is unchanged; this wrapper
+// only does what a Node extension host does for it before `activate`: make the private file
+// system ready and put the extension's own resources where `ctx.extensionPath` says they are.
+'use strict';
+
+// host.js reads this to know the code is running in the browser build (no shell, no ripgrep).
+globalThis.__LEVELCODE_BROWSER_HOST__ = true;
+
+const fs = require('fs');                 // aliased to ./shims/fs.js by build.mjs
+const assets = require('./assets.generated.js');
+const real = require('../../extensions/levelcode-ai/extension.js');
+
+async function activate(context) {
+	// Everything that reads a file synchronously needs the saved state in memory first.
+	await fs.__levelcode.ready;
+	fs.__levelcode.mountAssets(context.extensionPath, assets);
+	globalThis.__lcExtPath = context.extensionPath;   // stands in for __dirname (see build.mjs)
+	return real.activate(context);
+}
+
+async function deactivate() {
+	try { if (real.deactivate) { await real.deactivate(); } }
+	finally { await fs.__levelcode.flush(); }
+}
+
+module.exports = { activate, deactivate };
@@ -0,0 +1,4 @@
+// What esbuild substitutes for the Node globals the extension's sources mention.
+import proc from './shims/process.js';
+import { Buffer } from 'buffer';
+export { proc as process, Buffer };
@@ -0,0 +1,21 @@
+// `child_process` for the browser build: there is no machine to run a program on. Every entry
+// point fails the way Node fails for an unsupported syscall, so callers that already handle a
+// spawn error (all of them do: it is what a missing ripgrep looks like) take their normal path.
+// The agent's shell tools are not offered at all in this build (host.js `caps.shell`).
+'use strict';
+function unavailable(name) {
+	return function () {
+		const e = new Error('child_process.' + name + ' is not available in LevelCode in the browser');
+		e.code = 'ENOSYS';
+		throw e;
+	};
+}
+module.exports = {
+	spawn: unavailable('spawn'),
+	spawnSync: unavailable('spawnSync'),
+	exec: unavailable('exec'),
+	execSync: unavailable('execSync'),
+	execFile: unavailable('execFile'),
+	execFileSync: unavailable('execFileSync'),
+	fork: unavailable('fork'),
+};
@@ -0,0 +1,104 @@
+// `crypto` for the browser build: the three things the extension uses.
+//
+//   randomBytes(n)                         from the platform CSPRNG
+//   randomUUID()
+//   createHash('sha256').update(x).digest(enc)   SYNCHRONOUS, which WebCrypto is not, so the digest is
+//                                                computed here (FIPS 180-4). PKCE (extension.js) and the
+//                                                image store both need it inline.
+'use strict';
+const { Buffer } = require('buffer');
+
+const K = new Uint32Array([
+	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+	0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+	0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+	0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+	0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+	0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+class Sha256 {
+	constructor() {
+		this.h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+		this.block = new Uint8Array(64);
+		this.blockLen = 0;
+		this.total = 0;
+		this.w = new Uint32Array(64);
+		this.done = false;
+	}
+	update(data, encoding) {
+		if (this.done) { throw new Error('Digest already called'); }
+		const bytes = typeof data === 'string' ? Buffer.from(data, encoding || 'utf8') : data;
+		for (let i = 0; i < bytes.length; i++) {
+			this.block[this.blockLen++] = bytes[i];
+			if (this.blockLen === 64) { this.compress(); this.blockLen = 0; }
+		}
+		this.total += bytes.length;
+		return this;
+	}
+	compress() {
+		const w = this.w;
+		const b = this.block;
+		for (let i = 0; i < 16; i++) { w[i] = (b[i * 4] << 24) | (b[i * 4 + 1] << 16) | (b[i * 4 + 2] << 8) | b[i * 4 + 3]; }
+		for (let i = 16; i < 64; i++) {
+			const a = w[i - 15], c = w[i - 2];
+			const s0 = ((a >>> 7) | (a << 25)) ^ ((a >>> 18) | (a << 14)) ^ (a >>> 3);
+			const s1 = ((c >>> 17) | (c << 15)) ^ ((c >>> 19) | (c << 13)) ^ (c >>> 10);
+			w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+		}
+		let [a, b2, c, d, e, f, g, h] = this.h;
+		for (let i = 0; i < 64; i++) {
+			const S1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
+			const ch = (e & f) ^ (~e & g);
+			const t1 = (h + S1 + ch + K[i] + w[i]) | 0;
+			const S0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
+			const maj = (a & b2) ^ (a & c) ^ (b2 & c);
+			const t2 = (S0 + maj) | 0;
+			h = g; g = f; f = e; e = (d + t1) | 0; d = c; c = b2; b2 = a; a = (t1 + t2) | 0;
+		}
+		const H = this.h;
+		H[0] = (H[0] + a) | 0; H[1] = (H[1] + b2) | 0; H[2] = (H[2] + c) | 0; H[3] = (H[3] + d) | 0;
+		H[4] = (H[4] + e) | 0; H[5] = (H[5] + f) | 0; H[6] = (H[6] + g) | 0; H[7] = (H[7] + h) | 0;
+	}
+	digest(encoding) {
+		if (this.done) { throw new Error('Digest already called'); }
+		this.done = true;
+		const bitLen = this.total * 8;
+		this.block[this.blockLen++] = 0x80;
+		if (this.blockLen > 56) {
+			this.block.fill(0, this.blockLen);
+			this.compress();
+			this.blockLen = 0;
+		}
+		this.block.fill(0, this.blockLen, 56);
+		const hi = Math.floor(bitLen / 0x100000000);
+		const lo = bitLen >>> 0;
+		for (let i = 0; i < 4; i++) { this.block[56 + i] = (hi >>> (24 - i * 8)) & 0xff; this.block[60 + i] = (lo >>> (24 - i * 8)) & 0xff; }
+		this.compress();
+		const out = Buffer.alloc(32);
+		for (let i = 0; i < 8; i++) { out.writeUInt32BE(this.h[i] >>> 0, i * 4); }
+		return encoding ? out.toString(encoding) : out;
+	}
+}
+
+function createHash(algorithm) {
+	const name = String(algorithm).toLowerCase();
+	if (name !== 'sha256') {
+		const e = new Error('Digest method not supported: ' + algorithm);
+		e.code = 'ERR_CRYPTO_INVALID_DIGEST';
+		throw e;
+	}
+	return new Sha256();
+}
+
+function randomBytes(size) {
+	const out = Buffer.alloc(size);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+
+function randomUUID() { return globalThis.crypto.randomUUID(); }
+
+module.exports = { createHash, randomBytes, randomUUID };