diff --git a/apps/web/package.json b/apps/web/package.json
index da726afa..2e0925d3 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -38,6 +38,7 @@
     "@base-ui/react": "^1.1.0",
     "@bufbuild/protobuf": "^2.10.2",
     "@connectrpc/connect": "^2.1.1",
+    "@connectrpc/connect-query": "^2.3.1",
     "@connectrpc/connect-web": "^2.1.1",
     "@distilled.cloud/cloudflare": "catalog:",
     "@fontsource-variable/google-sans-code": "^5.2.3",
diff --git a/apps/web/src/components/project-selector.test.tsx b/apps/web/src/components/project-selector.test.tsx
new file mode 100644
index 00000000..448ce7fb
--- /dev/null
+++ b/apps/web/src/components/project-selector.test.tsx
@@ -0,0 +1,128 @@
+import { Code, ConnectError, createRouterTransport } from "@connectrpc/connect";
+import { TransportProvider } from "@connectrpc/connect-query";
+import { ProjectService } from "@stackpanel/proto/agent/v1/project";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { ProjectSelector } from "./project-selector";
+
+const { agentClient, endpoint } = vi.hoisted(() => ({
+  agentClient: { getCurrentProject: vi.fn(), openProject: vi.fn() },
+  endpoint: { isDemo: false, useLocal: () => {} },
+}));
+
+vi.mock("@tanstack/react-router", () => ({ useNavigate: () => () => {} }));
+vi.mock("@/lib/agent-endpoint", () => ({ useAgentEndpoint: () => endpoint }));
+vi.mock("@/lib/agent-provider", () => ({
+  useAgentContext: () => ({
+    host: "localhost",
+    port: 9876,
+    token: "paired-token",
+    healthStatus: "available",
+    isAuthenticated: true,
+  }),
+  useAgentClient: () => agentClient,
+}));
+
+const shop = { id: "shop-1", name: "shop", path: "/work/shop", valid: true };
+const api = { id: "api-2", name: "api", path: "/work/api", valid: true };
+const gone = {
+  id: "gone-3",
+  name: "gone",
+  path: "/work/gone",
+  valid: false,
+  invalidReason: "project directory does not exist",
+};
+
+// Serves ProjectService in memory, the way the agent's v1 handler answers.
+function renderSelector() {
+  const calls = { listProjects: 0 };
+  const transport = createRouterTransport(({ service }) => {
+    service(ProjectService, {
+      listProjects: () => {
+        calls.listProjects++;
+        return { projects: [shop, api, gone], defaultProjectId: shop.id };
+      },
+      addProject: () => {
+        throw new ConnectError(
+          "directory is not a git repository (no .git folder)",
+          Code.InvalidArgument,
+        );
+      },
+    });
+  });
+  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={queryClient}>
+      <TransportProvider transport={transport}>
+        <ProjectSelector />
+      </TransportProvider>
+    </QueryClientProvider>,
+  );
+  return calls;
+}
+
+async function openPicker() {
+  const trigger = await screen.findByRole("combobox");
+  await waitFor(() => expect(trigger.hasAttribute("data-disabled")).toBe(false));
+  fireEvent.click(trigger);
+  await screen.findAllByRole("option");
+}
+
+describe("ProjectSelector", () => {
+  beforeEach(() => {
+    endpoint.isDemo = false;
+    agentClient.getCurrentProject.mockResolvedValue({
+      has_project: true,
+      project: { id: shop.id, name: shop.name, path: shop.path },
+    });
+    agentClient.openProject.mockImplementation(async (path: string) => ({
+      success: true,
+      project: { id: "opened", name: "opened", path },
+    }));
+  });
+
+  it("lists the registry and disables projects the agent reports invalid", async () => {
+    renderSelector();
+    await openPicker();
+
+    expect(screen.getByRole("option", { name: /gone/ }).getAttribute("aria-disabled")).toBe("true");
+    expect(screen.getByText("project directory does not exist")).toBeTruthy();
+    expect(screen.getByRole("option", { name: /api/ }).getAttribute("aria-disabled")).toBeNull();
+  });
+
+  it("switches projects over REST and refreshes the registry", async () => {
+    const calls = renderSelector();
+    await openPicker();
+
+    fireEvent.click(screen.getByRole("option", { name: /api/ }));
+
+    await waitFor(() => expect(agentClient.openProject).toHaveBeenCalledWith(api.path));
+    await waitFor(() => expect(calls.listProjects).toBe(2));
+  });
+
+  it("shows why AddProject rejected the path", async () => {
+    renderSelector();
+    await openPicker();
+
+    fireEvent.click(screen.getByRole("option", { name: /Add project/ }));
+    fireEvent.change(await screen.findByLabelText("Project Path"), {
+      target: { value: "/work/plain-dir" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Add Project" }));
+
+    expect(
+      await screen.findByText("directory is not a git repository (no .git folder)"),
+    ).toBeTruthy();
+    expect(agentClient.openProject).not.toHaveBeenCalled();
+  });
+
+  it("stays off the network in demo mode", async () => {
+    endpoint.isDemo = true;
+    const calls = renderSelector();
+
+    expect(await screen.findByText("stackpanel-demo")).toBeTruthy();
+    expect(calls.listProjects).toBe(0);
+    expect(agentClient.getCurrentProject).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/components/project-selector.tsx b/apps/web/src/components/project-selector.tsx
index 43aeb022..cfdfb04b 100644
--- a/apps/web/src/components/project-selector.tsx
+++ b/apps/web/src/components/project-selector.tsx
@@ -1,5 +1,13 @@
 "use client";
 
+import { ConnectError } from "@connectrpc/connect";
+import {
+  createConnectQueryKey,
+  useMutation as useConnectMutation,
+  useQuery as useConnectQuery,
+  useTransport,
+} from "@connectrpc/connect-query";
+import { ProjectService } from "@stackpanel/proto/agent/v1/project";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useNavigate } from "@tanstack/react-router";
 import { Button } from "@ui/button";
@@ -26,17 +34,7 @@ import { Check, FolderOpen, Loader2, LogOut, Plus } from "lucide-react";
 import { useState } from "react";
 import { toast } from "sonner";
 import { useAgentEndpoint } from "@/lib/agent-endpoint";
-import { useAgentContext } from "@/lib/agent-provider";
-import { useTRPC } from "@/utils/trpc";
-
-interface Project {
-  id?: string;
-  path: string;
-  name: string;
-  active?: boolean;
-  is_default?: boolean;
-  last_opened?: string;
-}
+import { useAgentClient, useAgentContext } from "@/lib/agent-provider";
 
 const ADD_PROJECT_VALUE = "__add_project__";
 
@@ -45,151 +43,112 @@ interface ProjectSelectorProps {
 }
 
 export function ProjectSelector(_props: ProjectSelectorProps) {
-  const { host, port, token, healthStatus } = useAgentContext();
+  const { host, port, token, healthStatus, isAuthenticated } = useAgentContext();
+  const agentClient = useAgentClient();
+  const transport = useTransport();
   const { isDemo, useLocal } = useAgentEndpoint();
   const [addDialogOpen, setAddDialogOpen] = useState(false);
   const [newProjectPath, setNewProjectPath] = useState("");
   const [validationError, setValidationError] = useState<string | null>(null);
   const navigate = useNavigate();
-
-  const trpc = useTRPC();
   const queryClient = useQueryClient();
 
-  // Query for listing projects (public endpoint).
-  // Disabled in demo mode — the picker doesn't need a project list because
-  // there's only one (the synthetic demo project).
-  const projectsQuery = useQuery(
-    trpc.agent.listProjects.queryOptions(
-      { host, port },
-      {
-        enabled: !isDemo && healthStatus === "available",
-        staleTime: 5000,
-      },
-    ),
+  // The project registry comes from the agent's v1 ProjectService, called
+  // from the browser. The demo stays off the network: it has one synthetic
+  // project and renders a badge instead of the picker.
+  const projectsQuery = useConnectQuery(
+    ProjectService.method.listProjects,
+    {},
+    { enabled: isAuthenticated && !isDemo, staleTime: 5000 },
   );
+  const listProjectsKey = createConnectQueryKey({
+    schema: ProjectService.method.listProjects,
+    transport,
+    cardinality: "finite",
+  });
 
-  // Query for current project (public endpoint)
-  const currentProjectQuery = useQuery(
-    trpc.agent.currentProject.queryOptions(
-      { host, port },
-      {
-        enabled: !isDemo && healthStatus === "available",
-        staleTime: 5000,
-      },
-    ),
-  );
+  // The rest of the Studio still runs against the agent's single current
+  // project, so reading and switching it stays on REST until requests select
+  // their project (ADR 0005, stackpanel-thq.8.1).
+  const currentProjectKey = ["agent", "project", "current", host, port];
+  const currentProjectQuery = useQuery({
+    queryKey: currentProjectKey,
+    queryFn: () => agentClient.getCurrentProject(),
+    enabled: !isDemo && healthStatus === "available",
+    staleTime: 5000,
+  });
 
-  // Mutation for opening a project
-  const openProjectMutation = useMutation(
-    trpc.agent.openProject.mutationOptions({
-      onSuccess: (data) => {
-        toast.success(`Opened project: ${data.project.name}`);
-        queryClient.invalidateQueries({
-          queryKey: trpc.agent.listProjects.queryKey(),
-        });
-        queryClient.invalidateQueries({
-          queryKey: trpc.agent.currentProject.queryKey(),
+  const openProjectMutation = useMutation({
+    mutationFn: (path: string) => agentClient.openProject(path),
+    onSuccess: ({ project }) => {
+      toast.success(`Opened project: ${project.name}`);
+      void queryClient.invalidateQueries({ queryKey: listProjectsKey });
+      void queryClient.invalidateQueries({ queryKey: currentProjectKey });
+      if (project.id) {
+        void navigate({
+          to: "/studio",
+          search: { project: project.id },
         });
-        // Update URL with project ID
-        const projectId = (data.project as Project).id;
-        if (projectId) {
-          navigate({
-            to: "/studio",
-            search: { project: projectId },
-          });
-        }
-      },
-      onError: (error) => {
-        toast.error(error.message || "Failed to open project");
-      },
-    }),
-  );
+      }
+    },
+    onError: (error) => {
+      toast.error(error.message || "Failed to open project");
+    },
+  });
 
-  // Mutation for validating a project
-  const validateProjectMutation = useMutation(
-    trpc.agent.validateProject.mutationOptions(),
-  );
+  // AddProject validates the directory and fails with InvalidArgument, and a
+  // message saying why, when it is not a stackpanel project.
+  const addProjectMutation = useConnectMutation(ProjectService.method.addProject, {
+    onSuccess: () => {
+      void queryClient.invalidateQueries({ queryKey: listProjectsKey });
+    },
+  });
 
-  // Cast to Project[] to include id field from updated API
-  const projects = (projectsQuery.data ?? []).map((p) => ({
-    ...p,
-    id: (p as Project).id,
-  })) as Project[];
-  const currentProject = currentProjectQuery.data?.has_project
-    ? ({
-        ...currentProjectQuery.data.project,
-        id: (currentProjectQuery.data.project as Project).id,
-      } as Project)
-    : null;
+  const projects = projectsQuery.data?.projects ?? [];
+  const defaultProjectId = projectsQuery.data?.defaultProjectId;
+  const currentProject = currentProjectQuery.data?.project ?? null;
   const isLoading = projectsQuery.isLoading || currentProjectQuery.isLoading;
   const isOpening = openProjectMutation.isPending;
+  const isAdding = addProjectMutation.isPending || openProjectMutation.isPending;
 
-  const handleSelectProject = async (value: string) => {
-    if (value === ADD_PROJECT_VALUE) {
+  const handleSelectProject = (path: string) => {
+    if (path === ADD_PROJECT_VALUE) {
       setAddDialogOpen(true);
       return;
     }
 
-    // Value can be project ID or path
-    const selectedProject = projects.find(
-      (p) => p.id === value || p.path === value,
-    );
+    const selectedProject = projects.find((p) => p.path === path);
+    if (!selectedProject?.valid || selectedProject.path === currentProject?.path) return;
 
-    if (
-      !selectedProject ||
-      selectedProject.path === currentProject?.path ||
-      !token
-    )
-      return;
+    openProjectMutation.mutate(selectedProject.path);
+  };
 
-    openProjectMutation.mutate({
-      path: selectedProject.path,
-      token,
-      host,
-      port,
-    });
+  const closeAddDialog = () => {
+    setAddDialogOpen(false);
+    setNewProjectPath("");
+    setValidationError(null);
   };
 
   const handleAddProject = async () => {
-    if (!newProjectPath.trim()) {
+    const path = newProjectPath.trim();
+    if (!path) {
       setValidationError("Please enter a project path");
       return;
     }
 
-    if (!token) {
-      setValidationError("You must pair with the agent first");
-      return;
-    }
-
     setValidationError(null);
 
     try {
-      // First validate the project
-      const validateResult = await validateProjectMutation.mutateAsync({
-        path: newProjectPath.trim(),
-        token,
-        host,
-        port,
-      });
-
-      if (!validateResult.valid) {
-        setValidationError(validateResult.message ?? "Invalid project path");
-        return;
-      }
-
-      // Now open the project
-      await openProjectMutation.mutateAsync({
-        path: newProjectPath.trim(),
-        token,
-        host,
-        port,
-      });
-
-      setAddDialogOpen(false);
-      setNewProjectPath("");
+      const { project } = await addProjectMutation.mutateAsync({ path });
+      await openProjectMutation.mutateAsync(project?.path ?? path);
+      closeAddDialog();
     } catch (err) {
       setValidationError(
-        err instanceof Error ? err.message : "Failed to add project",
+        err instanceof ConnectError
+          ? err.rawMessage
+          : err instanceof Error
+            ? err.message
+            : "Failed to add project",
       );
     }
   };
@@ -225,7 +184,7 @@ export function ProjectSelector(_props: ProjectSelectorProps) {
   return (
     <>
       <Select
-        disabled={isLoading || isOpening || !token}
+        disabled={!isAuthenticated || isLoading || isOpening}
         onValueChange={handleSelectProject}
         value={currentProject?.path ?? ""}
       >
@@ -257,31 +216,30 @@ export function ProjectSelector(_props: ProjectSelectorProps) {
           )}
         </SelectTrigger>
         <SelectContent>
-          {projects.length === 0 ? (
+          {projectsQuery.error ? (
+            <div className="px-2 py-4 text-center text-destructive text-sm">
+              Couldn't load projects: {projectsQuery.error.rawMessage}
+            </div>
+          ) : projects.length === 0 ? (
             <div className="px-2 py-4 text-center text-muted-foreground text-sm">
               No projects yet
             </div>
           ) : (
             projects.map((project) => (
-              <SelectItem
-                key={project.id || project.path}
-                value={project.id || project.path}
-              >
+              <SelectItem key={project.id} value={project.path} disabled={!project.valid}>
                 <div className="flex w-full items-center justify-between gap-2">
                   <div className="flex items-center gap-2">
                     <FolderOpen className="h-4 w-4 text-primary" />
                     <div className="flex flex-col">
                       <div className="flex items-center gap-2">
                         <span>{project.name}</span>
-                        {project.id && (
-                          <Badge
-                            variant="outline"
-                            className="text-[10px]  font-mono px-1 py-0"
-                          >
-                            {project.id}
-                          </Badge>
-                        )}
-                        {project.is_default && (
+                        <Badge
+                          variant="outline"
+                          className="text-[10px]  font-mono px-1 py-0"
+                        >
+                          {project.id}
+                        </Badge>
+                        {project.id === defaultProjectId && (
                           <Badge
                             variant="secondary"
                             className="text-[10px] px-1 py-0"
@@ -293,9 +251,16 @@ export function ProjectSelector(_props: ProjectSelectorProps) {
                       <span className="max-w-45 truncate text-primary text-xs">
                         {project.path}
                       </span>
+                      {!project.valid && (
+                        <span className="max-w-45 truncate text-destructive text-xs">
+                          {project.invalidReason}
+                        </span>
+                      )}
                     </div>
                   </div>
-                  {project.active && <Check className="h-4 w-4 text-accent" />}
+                  {project.path === currentProject?.path && (
+                    <Check className="h-4 w-4 text-accent" />
+                  )}
                 </div>
               </SelectItem>
             ))
@@ -331,7 +296,7 @@ export function ProjectSelector(_props: ProjectSelectorProps) {
                 }}
                 onKeyDown={(e) => {
                   if (e.key === "Enter") {
-                    handleAddProject();
+                    void handleAddProject();
                   }
                 }}
                 placeholder="/path/to/your/project"
@@ -358,28 +323,15 @@ export function ProjectSelector(_props: ProjectSelectorProps) {
             </div>
           </div>
           <DialogFooter>
-            <Button
-              onClick={() => {
-                setAddDialogOpen(false);
-                setNewProjectPath("");
-                setValidationError(null);
-              }}
-              variant="outline"
-            >
+            <Button onClick={closeAddDialog} variant="outline">
               Cancel
             </Button>
             <Button
               className="bg-accent text-accent-foreground hover:bg-accent/90"
-              disabled={
-                openProjectMutation.isPending ||
-                validateProjectMutation.isPending
-              }
+              disabled={isAdding}
               onClick={handleAddProject}
             >
-              {(openProjectMutation.isPending ||
-                validateProjectMutation.isPending) && (
-                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-              )}
+              {isAdding && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
               Add Project
             </Button>
           </DialogFooter>
@@ -388,42 +340,3 @@ export function ProjectSelector(_props: ProjectSelectorProps) {
     </>
   );
 }
-
-/**
- * Compact project indicator for headers/sidebars
- */
-export function ProjectIndicator() {
-  const { host, port, healthStatus } = useAgentContext();
-  const trpc = useTRPC();
-
-  const currentProjectQuery = useQuery(
-    trpc.agent.currentProject.queryOptions(
-      { host, port },
-      {
-        enabled: healthStatus === "available",
-        staleTime: 5000,
-        refetchInterval: 5000,
-      },
-    ),
-  );
-
-  const currentProject = currentProjectQuery.data?.has_project
-    ? currentProjectQuery.data.project
-    : null;
-
-  if (!currentProject) {
-    return (
-      <div className="flex items-center gap-2 text-muted-foreground text-xs">
-        <FolderOpen className="h-3 w-3" />
-        <span>No project</span>
-      </div>
-    );
-  }
-
-  return (
-    <div className="flex items-center gap-2 text-foreground text-xs">
-      <FolderOpen className="h-3 w-3 text-accent" />
-      <span className="max-w-[120px] truncate">{currentProject.name}</span>
-    </div>
-  );
-}
diff --git a/apps/web/src/components/studio/panels/overview-panel.tsx b/apps/web/src/components/studio/panels/overview-panel.tsx
index 3feee698..527684d9 100644
--- a/apps/web/src/components/studio/panels/overview-panel.tsx
+++ b/apps/web/src/components/studio/panels/overview-panel.tsx
@@ -31,9 +31,6 @@ export function OverviewPanel() {
         </Card>
       )}
 
-      {/* Security Status (AWS Session & Certificates) */}
-      {/*<SecurityStatusCard />*/}
-
       {/* Two-column layout for Process State and Services */}
       <div
         className={isCompact
diff --git a/apps/web/src/components/studio/security-status-card.tsx b/apps/web/src/components/studio/security-status-card.tsx
deleted file mode 100644
index 271c8ac1..00000000
--- a/apps/web/src/components/studio/security-status-card.tsx
+++ /dev/null
@@ -1,340 +0,0 @@
-"use client";
-
-import { useQuery } from "@tanstack/react-query";
-import { Badge } from "@ui/badge";
-import { Card, CardContent, CardHeader, CardTitle } from "@ui/card";
-import {
-	AlertCircle,
-	CheckCircle2,
-	Clock,
-	Cloud,
-	Loader2,
-	Lock,
-	Server,
-	ShieldAlert,
-	ShieldCheck,
-	XCircle,
-} from "lucide-react";
-import { useAgentContext } from "@/lib/agent-provider";
-import { useNixConfig } from "@/lib/use-agent";
-import { useTRPC } from "@/utils/trpc";
-
-type AWSSessionStatus = {
-	enabled: boolean;
-	valid: boolean;
-	expires_at?: string;
-	expires_in?: string;
-	profile_arn?: string;
-	role_arn?: string;
-	region?: string;
-	error?: string;
-	has_credentials: boolean;
-};
-
-type CertificateStatus = {
-	enabled: boolean;
-	valid: boolean;
-	expires_at?: string;
-	expires_in?: string;
-	subject?: string;
-	issuer?: string;
-	cert_path?: string;
-	error?: string;
-	ca_reachable: boolean;
-	ca_url?: string;
-};
-
-function StatusIcon({
-	status,
-	size = "sm",
-}: {
-	status: "valid" | "warning" | "error" | "disabled";
-	size?: "sm" | "md";
-}) {
-	const sizeClass = size === "sm" ? "h-4 w-4" : "h-5 w-5";
-
-	switch (status) {
-		case "valid":
-			return <CheckCircle2 className={`${sizeClass} text-accent`} />;
-		case "warning":
-			return <AlertCircle className={`${sizeClass} text-yellow-500`} />;
-		case "error":
-			return <XCircle className={`${sizeClass} text-destructive`} />;
-		case "disabled":
-			return <Clock className={`${sizeClass} text-muted-foreground`} />;
-	}
-}
-
-function AWSStatusSection({ status }: { status: AWSSessionStatus }) {
-	if (!status.enabled) {
-		return (
-			<div className="flex items-center gap-3 rounded-lg border border-border bg-secondary/30 p-3">
-				<div className="flex h-10 w-10 items-center justify-center rounded-lg bg-secondary">
-					<Cloud className="h-5 w-5 text-muted-foreground" />
-				</div>
-				<div className="flex-1">
-					<p className="font-medium text-muted-foreground text-sm">
-						AWS Roles Anywhere
-					</p>
-					<p className="text-muted-foreground text-xs">Not configured</p>
-				</div>
-				<Badge variant="outline" className="text-muted-foreground">
-					Disabled
-				</Badge>
-			</div>
-		);
-	}
-
-	const statusType = status.valid
-		? "valid"
-		: status.error
-			? "error"
-			: "warning";
-
-	return (
-		<div className="flex items-center gap-3 rounded-lg border border-border bg-secondary/30 p-3">
-			<div
-				className={`flex h-10 w-10 items-center justify-center rounded-lg ${
-					status.valid ? "bg-accent/20" : "bg-secondary"
-				}`}
-			>
-				<Cloud
-					className={`h-5 w-5 ${status.valid ? "text-accent" : "text-muted-foreground"}`}
-				/>
-			</div>
-			<div className="flex-1">
-				<div className="flex items-center gap-2">
-					<p className="font-medium text-foreground text-sm">
-						AWS Roles Anywhere
-					</p>
-					{status.valid && (
-						<Badge variant="outline" className="border-accent text-accent">
-							Active
-						</Badge>
-					)}
-				</div>
-				<p className="text-muted-foreground text-xs">
-					{status.valid
-						? status.region
-							? `Region: ${status.region}`
-							: "Session active"
-						: (status.error ?? "Session expired or invalid")}
-				</p>
-			</div>
-			<StatusIcon status={statusType} />
-		</div>
-	);
-}
-
-function CertificateStatusSection({ status }: { status: CertificateStatus }) {
-	if (!status.enabled) {
-		return (
-			<div className="flex items-center gap-3 rounded-lg border border-border bg-secondary/30 p-3">
-				<div className="flex h-10 w-10 items-center justify-center rounded-lg bg-secondary">
-					<Lock className="h-5 w-5 text-muted-foreground" />
-				</div>
-				<div className="flex-1">
-					<p className="font-medium text-muted-foreground text-sm">
-						Step CA Certificate
-					</p>
-					<p className="text-muted-foreground text-xs">Not configured</p>
-				</div>
-				<Badge variant="outline" className="text-muted-foreground">
-					Disabled
-				</Badge>
-			</div>
-		);
-	}
-
-	const statusType = status.valid
-		? "valid"
-		: status.error
-			? "error"
-			: "warning";
-
-	return (
-		<div className="space-y-2">
-			{/* Certificate Status */}
-			<div className="flex items-center gap-3 rounded-lg border border-border bg-secondary/30 p-3">
-				<div
-					className={`flex h-10 w-10 items-center justify-center rounded-lg ${
-						status.valid ? "bg-accent/20" : "bg-secondary"
-					}`}
-				>
-					<Lock
-						className={`h-5 w-5 ${status.valid ? "text-accent" : "text-muted-foreground"}`}
-					/>
-				</div>
-				<div className="flex-1">
-					<div className="flex items-center gap-2">
-						<p className="font-medium text-foreground text-sm">
-							Device Certificate
-						</p>
-						{status.valid && (
-							<Badge variant="outline" className="border-accent text-accent">
-								Valid
-							</Badge>
-						)}
-					</div>
-					<p className="text-muted-foreground text-xs">
-						{status.valid
-							? status.expires_in
-								? `Expires in ${status.expires_in}`
-								: (status.subject ?? "Certificate valid")
-							: (status.error ?? "Certificate invalid or expired")}
-					</p>
-				</div>
-				<StatusIcon status={statusType} />
-			</div>
-
-			{/* CA Reachability */}
-			<div className="flex items-center gap-3 rounded-lg border border-border bg-secondary/30 p-3">
-				<div
-					className={`flex h-10 w-10 items-center justify-center rounded-lg ${
-						status.ca_reachable ? "bg-accent/20" : "bg-secondary"
-					}`}
-				>
-					<Server
-						className={`h-5 w-5 ${status.ca_reachable ? "text-accent" : "text-muted-foreground"}`}
-					/>
-				</div>
-				<div className="flex-1">
-					<div className="flex items-center gap-2">
-						<p className="font-medium text-foreground text-sm">Internal CA</p>
-						{status.ca_reachable && (
-							<Badge variant="outline" className="border-accent text-accent">
-								Reachable
-							</Badge>
-						)}
-					</div>
-					<p className="text-muted-foreground text-xs">
-						{status.ca_url ?? "Step CA server"}
-					</p>
-				</div>
-				<StatusIcon status={status.ca_reachable ? "valid" : "error"} />
-			</div>
-		</div>
-	);
-}
-
-export function SecurityStatusCard() {
-	const { host, port, token, isConnected } = useAgentContext();
-	const { data: config } = useNixConfig();
-	const trpc = useTRPC();
-
-	// Type-safe access to optional config properties
-	const awsConfig = config as { aws?: { "roles-anywhere"?: { enable?: boolean } } } | null;
-	const stepCaConfig = config as { stepCa?: { "step-ca"?: { enable?: boolean } } } | null;
-
-	// Check if AWS or Step CA are configured in the nix config
-	const awsEnabled = awsConfig?.aws?.["roles-anywhere"]?.enable ?? false;
-	const stepCaEnabled = stepCaConfig?.stepCa?.["step-ca"]?.enable ?? false;
-
-	// Don't show the card if neither feature is enabled
-	const shouldShow = awsEnabled || stepCaEnabled;
-
-	const {
-		data: securityStatus,
-		isLoading,
-		error,
-	} = useQuery(
-		trpc.agent.getSecurityStatus.queryOptions(
-			{ host, port, token: token ?? "" },
-			{
-				enabled: isConnected && !!token && shouldShow,
-				staleTime: 30000, // 30 seconds
-				refetchInterval: 60000, // Refresh every minute
-			},
-		),
-	);
-
-	// Don't render if features are not enabled
-	if (!shouldShow) {
-		return null;
-	}
-
-	// Loading state
-	if (isLoading || !securityStatus) {
-		return (
-			<Card>
-				<CardHeader>
-					<CardTitle className="flex items-center gap-2 font-medium text-base">
-						<ShieldCheck className="h-4 w-4 text-accent" />
-						Security Status
-					</CardTitle>
-				</CardHeader>
-				<CardContent>
-					<div className="flex items-center justify-center py-8">
-						<Loader2 className="h-6 w-6 animate-spin text-muted-foreground" />
-						<span className="ml-2 text-muted-foreground text-sm">
-							Checking security status...
-						</span>
-					</div>
-				</CardContent>
-			</Card>
-		);
-	}
-
-	// Error state
-	if (error) {
-		return (
-			<Card>
-				<CardHeader>
-					<CardTitle className="flex items-center gap-2 font-medium text-base">
-						<ShieldAlert className="h-4 w-4 text-destructive" />
-						Security Status
-					</CardTitle>
-				</CardHeader>
-				<CardContent>
-					<div className="flex items-center gap-2 rounded-lg border border-destructive/30 bg-destructive/10 p-3">
-						<AlertCircle className="h-5 w-5 text-destructive" />
-						<p className="text-destructive text-sm">
-							Unable to check security status
-						</p>
-					</div>
-				</CardContent>
-			</Card>
-		);
-	}
-
-	// Calculate overall status
-	const awsOk = !securityStatus.aws.enabled || securityStatus.aws.valid;
-	const certOk =
-		!securityStatus.certificate.enabled || securityStatus.certificate.valid;
-	const caOk =
-		!securityStatus.certificate.enabled ||
-		securityStatus.certificate.ca_reachable;
-	const allOk = awsOk && certOk && caOk;
-
-	return (
-		<Card>
-			<CardHeader>
-				<CardTitle className="flex items-center gap-2 font-medium text-base">
-					{allOk ? (
-						<ShieldCheck className="h-4 w-4 text-accent" />
-					) : (
-						<ShieldAlert className="h-4 w-4 text-yellow-500" />
-					)}
-					Security Status
-				</CardTitle>
-			</CardHeader>
-			<CardContent className="space-y-3">
-				{awsEnabled && <AWSStatusSection status={securityStatus.aws} />}
-				{stepCaEnabled && (
-					<CertificateStatusSection status={securityStatus.certificate} />
-				)}
-
-				{allOk && (
-					<div className="rounded-lg border border-accent/20 bg-accent/5 p-3">
-						<div className="flex items-center gap-2">
-							<span className="h-2 w-2 rounded-full bg-accent" />
-							<span className="font-medium text-foreground text-sm">
-								All security checks passed
-							</span>
-						</div>
-					</div>
-				)}
-			</CardContent>
-		</Card>
-	);
-}
diff --git a/apps/web/src/lib/agent-provider.tsx b/apps/web/src/lib/agent-provider.tsx
index b8789514..64e263b3 100644
--- a/apps/web/src/lib/agent-provider.tsx
+++ b/apps/web/src/lib/agent-provider.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { TransportProvider } from "@connectrpc/connect-query";
 import {
   createContext,
   type ReactNode,
@@ -11,6 +12,7 @@ import {
   useState,
 } from "react";
 import { AgentHttpClient } from "./agent";
+import { createAgentTransport } from "./connect-transport";
 import { useAgent, useAgentHealth } from "@/lib/use-agent";
 import { useAgentSSEOptional } from "@/lib/agent-sse-provider";
 
@@ -340,6 +342,13 @@ export function AgentProvider({
     healthStatus === "available" && !!effectiveToken && validatedToken === effectiveToken;
   const isConnected = isAuthenticated;
 
+  // The one Connect transport for this agent and credential; connect-query
+  // hooks below pick it up from TransportProvider (ADR 0004).
+  const transport = useMemo(
+    () => createAgentTransport(effectiveToken, host, port),
+    [effectiveToken, host, port],
+  );
+
   const value = useMemo<AgentContextValue>(
     () => ({
       host,
@@ -389,7 +398,11 @@ export function AgentProvider({
     ],
   );
 
-  return <AgentContext.Provider value={value}>{children}</AgentContext.Provider>;
+  return (
+    <AgentContext.Provider value={value}>
+      <TransportProvider transport={transport}>{children}</TransportProvider>
+    </AgentContext.Provider>
+  );
 }
 
 export function useAgentContext(): AgentContextValue {
diff --git a/apps/web/src/lib/agent-setup.test.ts b/apps/web/src/lib/agent-setup.test.ts
index e19ad6e0..d3fa8810 100644
--- a/apps/web/src/lib/agent-setup.test.ts
+++ b/apps/web/src/lib/agent-setup.test.ts
@@ -38,4 +38,40 @@ describe("agent onboarding responses", () => {
       headers: { "X-Stackpanel-Token": "paired-token" },
     });
   });
+
+  it("unwraps the current project from the agent and accepts the demo's bare shape", async () => {
+    const current = {
+      has_project: true,
+      project: { id: "project", name: "my-app", path: "/work/my-app" },
+    };
+    vi.mocked(fetch).mockResolvedValueOnce(Response.json({ success: true, data: current }));
+    expect(await client.getCurrentProject()).toEqual(current);
+    vi.mocked(fetch).mockResolvedValueOnce(Response.json(current));
+    expect(await client.getCurrentProject()).toEqual(current);
+  });
+
+  it("opens a project and surfaces the agent's reason when it refuses", async () => {
+    const project = { id: "project", name: "my-app", path: "/work/my-app" };
+    vi.mocked(fetch).mockResolvedValueOnce(
+      Response.json({ success: true, data: { success: true, project } }),
+    );
+    expect((await client.openProject("/work/my-app")).project).toEqual(project);
+
+    vi.mocked(fetch).mockResolvedValueOnce(
+      Response.json(
+        {
+          success: true,
+          data: {
+            valid: false,
+            error: "not_git_repo",
+            message: "Directory is not a git repository",
+          },
+        },
+        { status: 400 },
+      ),
+    );
+    await expect(client.openProject("/work/plain-dir")).rejects.toThrow(
+      "Directory is not a git repository",
+    );
+  });
 });
diff --git a/apps/web/src/lib/agent.ts b/apps/web/src/lib/agent.ts
index 61b6d4cb..9586e7ee 100644
--- a/apps/web/src/lib/agent.ts
+++ b/apps/web/src/lib/agent.ts
@@ -1087,11 +1087,13 @@ export class AgentHttpClient {
     };
   }
 
+  // The agent wraps both project responses as { success, data }; the demo
+  // agent returns them bare.
   async getCurrentProject(): Promise<ProjectCurrentResponse> {
-    const res = await fetch(`${this.baseUrl}/api/project/current`, {
-      headers: this.getHeaders(false),
-    });
-    return res.json();
+    const body = await this.get<ProjectCurrentResponse | { data: ProjectCurrentResponse }>(
+      "/api/project/current",
+    );
+    return "data" in body ? body.data : body;
   }
 
   async openProject(path: string): Promise<ProjectOpenResponse> {
@@ -1100,9 +1102,11 @@ export class AgentHttpClient {
       headers: this.getHeaders(true),
       body: JSON.stringify({ path }),
     });
-    const data = await res.json();
-    if (!data.success && data.error) {
-      throw new Error(data.message ?? data.error);
+    if (res.status === 401) dispatchAuthError();
+    const body = await res.json().catch(() => null);
+    const data = body?.data ?? body;
+    if (!res.ok || !data?.project) {
+      throw new Error(data?.message ?? body?.error ?? `Failed to open project (${res.status})`);
     }
     return data;
   }
diff --git a/apps/web/src/lib/connect-transport.ts b/apps/web/src/lib/connect-transport.ts
index 78f5c0db..017091cc 100644
--- a/apps/web/src/lib/connect-transport.ts
+++ b/apps/web/src/lib/connect-transport.ts
@@ -13,17 +13,18 @@ import { AGENT_AUTH_ERROR_EVENT } from "./agent";
 /**
  * Creates a Connect transport configured for the local agent.
  *
- * @param token - JWT auth token for the agent
+ * @param token - JWT auth token for the agent; without one, only public
+ *   procedures such as GetAgentInfo succeed
  * @param host - Agent host (default localhost)
  * @param port - Agent port (default 9876)
  */
 export function createAgentTransport(
-	token: string,
+	token: string | null | undefined,
 	host: string = "localhost",
 	port: number = 9876,
 ) {
 	const authInterceptor: Interceptor = (next) => async (req) => {
-		req.header.set("Authorization", `Bearer ${token}`);
+		if (token) req.header.set("Authorization", `Bearer ${token}`);
 		try {
 			return await next(req);
 		} catch (err) {
diff --git a/apps/web/src/lib/use-agent.ts b/apps/web/src/lib/use-agent.ts
index 31e9f205..13ba7bc5 100644
--- a/apps/web/src/lib/use-agent.ts
+++ b/apps/web/src/lib/use-agent.ts
@@ -23,13 +23,13 @@
  */
 
 import { createClient } from "@connectrpc/connect";
+import { useTransport } from "@connectrpc/connect-query";
 import { AgentService } from "@stackpanel/proto/agent-service";
 import type { Apps, Variables, Users, Secrets } from "@stackpanel/proto";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useEffect, useMemo, useState } from "react";
 import { flattenConfiguredAppVariables } from "./app-env";
 import { useAgentContext, useAgentClient } from "./agent-provider";
-import { createAgentTransport } from "./connect-transport";
 import { useAgentSSEEvent } from "./agent-sse-provider";
 import { AgentHttpClient, type AppVariableLinks } from "./agent";
 import type { RecipientListResponse, RekeyWorkflowStatus } from "./types";
@@ -195,13 +195,13 @@ export function useAgentHealth(
  * Returns null if not connected.
  */
 export function useAgentRpcClient() {
-  const { host, port, token, isConnected } = useAgentContext();
+  const { isConnected } = useAgentContext();
+  const transport = useTransport();
 
-  return useMemo(() => {
-    if (!isConnected || !token) return null;
-    const transport = createAgentTransport(token, host, port);
-    return createClient(AgentService, transport);
-  }, [host, isConnected, port, token]);
+  return useMemo(
+    () => (isConnected ? createClient(AgentService, transport) : null),
+    [isConnected, transport],
+  );
 }
 
 // =============================================================================
diff --git a/bun.lock b/bun.lock
index c64a3bb8..9d6a95a1 100644
--- a/bun.lock
+++ b/bun.lock
@@ -121,6 +121,7 @@
         "@base-ui/react": "^1.1.0",
         "@bufbuild/protobuf": "^2.10.2",
         "@connectrpc/connect": "^2.1.1",
+        "@connectrpc/connect-query": "^2.3.1",
         "@connectrpc/connect-web": "^2.1.1",
         "@distilled.cloud/cloudflare": "catalog:",
         "@fontsource-variable/google-sans-code": "^5.2.3",
@@ -864,6 +865,10 @@
 
     "@connectrpc/connect": ["@connectrpc/connect@2.1.1", "", { "peerDependencies": { "@bufbuild/protobuf": "^2.7.0" } }, "sha512-JzhkaTvM73m2K1URT6tv53k2RwngSmCXLZJgK580qNQOXRzZRR/BCMfZw3h+90JpnG6XksP5bYT+cz0rpUzUWQ=="],
 
+    "@connectrpc/connect-query": ["@connectrpc/connect-query@2.3.1", "", { "dependencies": { "@connectrpc/connect-query-core": "^2.3.1" }, "peerDependencies": { "@bufbuild/protobuf": "2.x", "@connectrpc/connect": "^2.0.1", "@tanstack/react-query": ">=5.62.0", "react": "^18 || ^19", "react-dom": "^18 || ^19" } }, "sha512-ck1erTsLwD0nhagrK3AhghTz3t8IVVaLkAWMLu30tw/hGJGxEvjkSUM6YwW1mCwt2d6MCl/h1P1as+oQWmnFRg=="],
+
+    "@connectrpc/connect-query-core": ["@connectrpc/connect-query-core@2.3.1", "", { "peerDependencies": { "@bufbuild/protobuf": "2.x", "@connectrpc/connect": "^2.0.1", "@tanstack/query-core": ">=5.62.0" } }, "sha512-zFnNzvX+ao9/w1GoDOSRtKcejfAS1bF1XH7HpDPnnzINoXQ/wVz5lhLIdgekhYgkbsw8to6whw4/tUxMKwlaiA=="],
+
     "@connectrpc/connect-web": ["@connectrpc/connect-web@2.1.1", "", { "peerDependencies": { "@bufbuild/protobuf": "^2.7.0", "@connectrpc/connect": "2.1.1" } }, "sha512-J8317Q2MaFRCT1jzVR1o06bZhDIBmU0UAzWx6xOIXzOq8+k71/+k7MUF7AwcBUX+34WIvbm5syRgC5HXQA8fOg=="],
 
     "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="],
diff --git a/bun.nix b/bun.nix
index 750416a1..3f887a94 100644
--- a/bun.nix
+++ b/bun.nix
@@ -689,10 +689,6 @@
     url = "https://registry.npmjs.org/@cloudflare/unenv-preset/-/unenv-preset-2.7.7.tgz";
     hash = "sha512-HtZuh166y0Olbj9bqqySckz0Rw9uHjggJeoGbDx5x+sgezBXlxO6tQSig2RZw5tgObF8mWI8zaPvQMkQZtAODw==";
   };
-  "@cloudflare/vite-plugin@1.35.0" = fetchurl {
-    url = "https://registry.npmjs.org/@cloudflare/vite-plugin/-/vite-plugin-1.35.0.tgz";
-    hash = "sha512-TtyBYqeIcRrbEAShwnNOyaMHA8SnwIFQ5h9OtMF3mr0xEF9XHqnICkZqMLGOFSP9INrjtJKUBIDlWbK+fjSBmA==";
-  };
   "@cloudflare/workerd-darwin-64@1.20260430.1" = fetchurl {
     url = "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260430.1.tgz";
     hash = "sha512-ADohZUHf7NBvPp2PdZig2Opxx+hDkk3ve7jrTne3JRx9kDSB73zc4LzcEeEN8LKkbAcqZmvfRJfpChSlusu0lA==";
@@ -789,6 +785,14 @@
     url = "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz";
     hash = "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==";
   };
+  "@connectrpc/connect-query-core@2.3.1" = fetchurl {
+    url = "https://registry.npmjs.org/@connectrpc/connect-query-core/-/connect-query-core-2.3.1.tgz";
+    hash = "sha512-zFnNzvX+ao9/w1GoDOSRtKcejfAS1bF1XH7HpDPnnzINoXQ/wVz5lhLIdgekhYgkbsw8to6whw4/tUxMKwlaiA==";
+  };
+  "@connectrpc/connect-query@2.3.1" = fetchurl {
+    url = "https://registry.npmjs.org/@connectrpc/connect-query/-/connect-query-2.3.1.tgz";
+    hash = "sha512-ck1erTsLwD0nhagrK3AhghTz3t8IVVaLkAWMLu30tw/hGJGxEvjkSUM6YwW1mCwt2d6MCl/h1P1as+oQWmnFRg==";
+  };
   "@connectrpc/connect-web@2.1.1" = fetchurl {
     url = "https://registry.npmjs.org/@connectrpc/connect-web/-/connect-web-2.1.1.tgz";
     hash = "sha512-J8317Q2MaFRCT1jzVR1o06bZhDIBmU0UAzWx6xOIXzOq8+k71/+k7MUF7AwcBUX+34WIvbm5syRgC5HXQA8fOg==";
@@ -4069,22 +4073,6 @@
     url = "https://registry.npmjs.org/@tsconfig/bun/-/bun-1.0.7.tgz";
     hash = "sha512-udGrGJBNQdXGVulehc1aWT73wkR9wdaGBtB6yL70RJsqwW/yJhIg6ZbRlPOfIUiFNrnBuYLBi9CSmMKfDC7dvA==";
   };
-  "@tsconfig/node10@1.0.12" = fetchurl {
-    url = "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.12.tgz";
-    hash = "sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ==";
-  };
-  "@tsconfig/node12@1.0.11" = fetchurl {
-    url = "https://registry.npmjs.org/@tsconfig/node12/-/node12-1.0.11.tgz";
-    hash = "sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag==";
-  };
-  "@tsconfig/node14@1.0.3" = fetchurl {
-    url = "https://registry.npmjs.org/@tsconfig/node14/-/node14-1.0.3.tgz";
-    hash = "sha512-ysT8mhdixWK6Hw3i1V2AeRqZ5WfXg1G43mqoYlM2nc6388Fq5jcXyr5mRsqViLx/GJYdoL0bfXD8nmF+Zn/Iow==";
-  };
-  "@tsconfig/node16@1.0.4" = fetchurl {
-    url = "https://registry.npmjs.org/@tsconfig/node16/-/node16-1.0.4.tgz";
-    hash = "sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA==";
-  };
   "@tsconfig/node18@1.0.3" = fetchurl {
     url = "https://registry.npmjs.org/@tsconfig/node18/-/node18-1.0.3.tgz";
     hash = "sha512-RbwvSJQsuN9TB04AQbGULYfOGE/RnSFk/FLQ5b0NmDf5Kx2q/lABZbHQPKCO1vZ6Fiwkplu+yb9pGdLy1iGseQ==";
@@ -4773,10 +4761,6 @@
     url = "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz";
     hash = "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==";
   };
-  "acorn-walk@8.3.5" = fetchurl {
-    url = "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz";
-    hash = "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==";
-  };
   "acorn@8.16.0" = fetchurl {
     url = "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz";
     hash = "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==";
@@ -4866,10 +4850,6 @@
     hash = "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==";
   };
   "api" = copyPathToStore ./apps/api;
-  "arg@4.1.3" = fetchurl {
-    url = "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz";
-    hash = "sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==";
-  };
   "argparse@1.0.10" = fetchurl {
     url = "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz";
     hash = "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==";
@@ -4942,10 +4922,6 @@
     url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1692.0.tgz";
     hash = "sha512-x511uiJ/57FIsbgUe5csJ13k3uzu25uWQE+XqfBis/sB0SFoiElJWXRkgEAUh0U6n40eT3ay5Ue4oPkRMu1LYw==";
   };
-  "aws-ssl-profiles@1.1.2" = fetchurl {
-    url = "https://registry.npmjs.org/aws-ssl-profiles/-/aws-ssl-profiles-1.1.2.tgz";
-    hash = "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==";
-  };
   "aws4fetch@1.0.18" = fetchurl {
     url = "https://registry.npmjs.org/aws4fetch/-/aws4fetch-1.0.18.tgz";
     hash = "sha512-3Cf+YaUl07p24MoQ46rFwulAmiyCwH2+1zw1ZyPAX5OtJ34Hh185DwB8y/qRLb6cYYYtSFJ9pthyLc0MD4e8sQ==";
@@ -5450,10 +5426,6 @@
     url = "https://registry.npmjs.org/countries-list/-/countries-list-3.3.0.tgz";
     hash = "sha512-XRUjS+dcZuNh/fg3+mka3bXgcg4TbQZ1gaK5IJqO6qulerBANl1bmrd20P2dgmPkBpP+5FnejiSF1gd7bgAg+g==";
   };
-  "create-require@1.1.1" = fetchurl {
-    url = "https://registry.npmjs.org/create-require/-/create-require-1.1.1.tgz";
-    hash = "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==";
-  };
   "cross-spawn@6.0.6" = fetchurl {
     url = "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.6.tgz";
     hash = "sha512-VqCUuhcd1iB+dsv8gxPttb5iZh/D0iubSP21g36KXdEuf6I5JiioesUVjpCdHV9MZRUfVFlvwtIUyPfxo5trtw==";
@@ -5462,10 +5434,6 @@
     url = "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz";
     hash = "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==";
   };
-  "crossws@0.4.5" = fetchurl {
-    url = "https://registry.npmjs.org/crossws/-/crossws-0.4.5.tgz";
-    hash = "sha512-wUR89x/Rw7/8t+vn0CmGDYM9TD6VtARGb0LD5jq2wjtMy1vCP4M+sm6N6TigWeTYvnA8MoW29NqqXD0ep0rfBA==";
-  };
   "css-select@5.2.2" = fetchurl {
     url = "https://registry.npmjs.org/css-select/-/css-select-5.2.2.tgz";
     hash = "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw==";
@@ -5738,10 +5706,6 @@
     url = "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz";
     hash = "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==";
   };
-  "denque@2.1.0" = fetchurl {
-    url = "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz";
-    hash = "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==";
-  };
   "depd@2.0.0" = fetchurl {
     url = "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz";
     hash = "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==";
@@ -5774,10 +5738,6 @@
     url = "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz";
     hash = "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==";
   };
-  "diff@4.0.4" = fetchurl {
-    url = "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz";
-    hash = "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==";
-  };
   "diff@8.0.2" = fetchurl {
     url = "https://registry.npmjs.org/diff/-/diff-8.0.2.tgz";
     hash = "sha512-sSuxWU5j5SR9QQji/o2qMvqRNYRDOcBTgsJ/DeCf4iSN4gW+gNMXM7wFIP+fdXZxoNiAnHUTGjCr+TSWXdRDKg==";
@@ -6391,10 +6351,6 @@
     url = "https://registry.npmjs.org/fuzzysort/-/fuzzysort-3.1.0.tgz";
     hash = "sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ==";
   };
-  "generate-function@2.3.1" = fetchurl {
-    url = "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz";
-    hash = "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==";
-  };
   "generator-function@2.0.1" = fetchurl {
     url = "https://registry.npmjs.org/generator-function/-/generator-function-2.0.1.tgz";
     hash = "sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==";
@@ -6955,10 +6911,6 @@
     url = "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz";
     hash = "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==";
   };
-  "is-property@1.0.2" = fetchurl {
-    url = "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz";
-    hash = "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==";
-  };
   "is-regex@1.2.1" = fetchurl {
     url = "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz";
     hash = "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==";
@@ -7535,10 +7487,6 @@
     url = "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz";
     hash = "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==";
   };
-  "lru.min@1.1.4" = fetchurl {
-    url = "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz";
-    hash = "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==";
-  };
   "lucide-react@0.547.0" = fetchurl {
     url = "https://registry.npmjs.org/lucide-react/-/lucide-react-0.547.0.tgz";
     hash = "sha512-YLChGBWKq8ynr1UWP8WWRPhHhyuBAXfSBnHSgfoj51L//9TU3d0zvxpigf5C1IJ4vnEoTzthl5awPK55PiZhdA==";
@@ -7563,10 +7511,6 @@
     url = "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz";
     hash = "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==";
   };
-  "make-error@1.3.6" = fetchurl {
-    url = "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz";
-    hash = "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==";
-  };
   "make-fetch-happen@15.0.5" = fetchurl {
     url = "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-15.0.5.tgz";
     hash = "sha512-uCbIa8jWWmQZt4dSnEStkVC6gdakiinAm4PiGsywIkguF0eWMdcjDz0ECYhUolFU3pFLOev9VNPCEygydXnddg==";
@@ -8007,18 +7951,10 @@
     url = "https://registry.npmjs.org/mute-stream/-/mute-stream-3.0.0.tgz";
     hash = "sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==";
   };
-  "mysql2@3.22.4" = fetchurl {
-    url = "https://registry.npmjs.org/mysql2/-/mysql2-3.22.4.tgz";
-    hash = "sha512-CtXYlmL7ZamiYKbmqkamQHWJROUHSfm+f3kByzGfknw7kW51mcB2ouMUqYq1XfYxbXmnWo6RhPydx6OCqdgcmQ==";
-  };
   "mz@2.7.0" = fetchurl {
     url = "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz";
     hash = "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
   };
-  "named-placeholders@1.1.6" = fetchurl {
-    url = "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz";
-    hash = "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==";
-  };
   "nanoid@3.3.12" = fetchurl {
     url = "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz";
     hash = "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==";
@@ -9031,18 +8967,10 @@
     url = "https://registry.npmjs.org/send/-/send-1.2.1.tgz";
     hash = "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==";
   };
-  "seroval-plugins@1.5.2" = fetchurl {
-    url = "https://registry.npmjs.org/seroval-plugins/-/seroval-plugins-1.5.2.tgz";
-    hash = "sha512-qpY0Cl+fKYFn4GOf3cMiq6l72CpuVaawb6ILjubOQ+diJ54LfOWaSSPsaswN8DRPIPW4Yq+tE1k5aKd7ILyaFg==";
-  };
   "seroval-plugins@1.5.4" = fetchurl {
     url = "https://registry.npmjs.org/seroval-plugins/-/seroval-plugins-1.5.4.tgz";
     hash = "sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw==";
   };
-  "seroval@1.5.2" = fetchurl {
-    url = "https://registry.npmjs.org/seroval/-/seroval-1.5.2.tgz";
-    hash = "sha512-xcRN39BdsnO9Tf+VzsE7b3JyTJASItIV1FVFewJKCFcW4s4haIKS3e6vj8PGB9qBwC7tnuOywQMdv5N4qkzi7Q==";
-  };
   "seroval@1.5.4" = fetchurl {
     url = "https://registry.npmjs.org/seroval/-/seroval-1.5.4.tgz";
     hash = "sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw==";
@@ -9179,10 +9107,6 @@
     url = "https://registry.npmjs.org/socks/-/socks-2.8.8.tgz";
     hash = "sha512-NlGELfPrgX2f1TAAcz0WawlLn+0r3FyhhCRpFFK2CemXenPYvzMWWZINv3eDNo9ucdwme7oCHRY0Jnbs4aIkog==";
   };
-  "solid-js@1.9.12" = fetchurl {
-    url = "https://registry.npmjs.org/solid-js/-/solid-js-1.9.12.tgz";
-    hash = "sha512-QzKaSJq2/iDrWR1As6MHZQ8fQkdOBf8GReYb7L5iKwMGceg7HxDcaOHk0at66tNgn9U2U7dXo8ZZpLIAmGMzgw==";
-  };
   "sonner@2.0.7" = fetchurl {
     url = "https://registry.npmjs.org/sonner/-/sonner-2.0.7.tgz";
     hash = "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w==";
@@ -9243,10 +9167,6 @@
     url = "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz";
     hash = "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==";
   };
-  "sql-escaper@1.3.3" = fetchurl {
-    url = "https://registry.npmjs.org/sql-escaper/-/sql-escaper-1.3.3.tgz";
-    hash = "sha512-BsTCV265VpTp8tm1wyIm1xqQCS+Q9NHx2Sr+WcnUrgLrQ6yiDIvHYJV5gHxsj1lMBy2zm5twLaZao8Jd+S8JJw==";
-  };
   "srvx@0.11.15" = fetchurl {
     url = "https://registry.npmjs.org/srvx/-/srvx-0.11.15.tgz";
     hash = "sha512-iXsux0UcOjdvs0LCMa2Ws3WwcDUozA3JN3BquNXkaFPP7TpRqgunKdEgoZ/uwb1J6xaYHfxtz9Twlh6yzwM6Tg==";
@@ -9644,10 +9564,6 @@
     url = "https://registry.npmjs.org/ts-morph/-/ts-morph-28.0.0.tgz";
     hash = "sha512-Wp3tnZ2bzwxyTZMtgWVzXDfm7lB1Drz+y9DmmYH/L702PQhPyVrp3pkou3yIz4qjS14GY9kcpmLiOOMvl8oG1g==";
   };
-  "ts-node@10.9.2" = fetchurl {
-    url = "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz";
-    hash = "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==";
-  };
   "ts-tqdm@0.8.6" = fetchurl {
     url = "https://registry.npmjs.org/ts-tqdm/-/ts-tqdm-0.8.6.tgz";
     hash = "sha512-3X3M1PZcHtgQbnwizL+xU8CAgbYbeLHrrDwL9xxcZZrV5J+e7loJm1XrXozHjSkl44J0Zg0SgA8rXbh83kCkcQ==";
@@ -9889,10 +9805,6 @@
     url = "https://registry.npmjs.org/uuid/-/uuid-8.0.0.tgz";
     hash = "sha512-jOXGuXZAWdsTH7eZLtyXMqUb9EcWMGZNbL9YcGBJl4MH4nrxHmZJhEHvyLFrkxo+28uLb/NYRcStH48fnD0Vzw==";
   };
-  "v8-compile-cache-lib@3.0.1" = fetchurl {
-    url = "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz";
-    hash = "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==";
-  };
   "v8-to-istanbul@9.3.0" = fetchurl {
     url = "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz";
     hash = "sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==";
@@ -10114,10 +10026,6 @@
     url = "https://registry.npmjs.org/workerd/-/workerd-1.20260704.1.tgz";
     hash = "sha512-GDZ0jzIYDYfN7rCt/oFJv4BG3QJ+4IS2kfRvxEMY9VKIfPhzo63PH69Ir7ug8LfORCgCtmfkiQVXrqbot7pZTQ==";
   };
-  "wrangler@4.87.0" = fetchurl {
-    url = "https://registry.npmjs.org/wrangler/-/wrangler-4.87.0.tgz";
-    hash = "sha512-lfhfKwLfQlowwgV0xhlYgE9fU3n0I30d4ccGY/rTCEm/n42Mjvlr0Ng3ZPNqlsrsKBcDR531V7dsPkgELvrk/Q==";
-  };
   "wrangler@4.90.0" = fetchurl {
     url = "https://registry.npmjs.org/wrangler/-/wrangler-4.90.0.tgz";
     hash = "sha512-bmNIykl59TfCUn5xQgU7IWylSsPx3LQaPLMSAq2VQHt89CBrcj9qXQ0eYfjBCWA5XTBVgten391evt7xxtXwcA==";
@@ -10246,10 +10154,6 @@
     url = "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz";
     hash = "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==";
   };
-  "yn@3.1.1" = fetchurl {
-    url = "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz";
-    hash = "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==";
-  };
   "yocto-queue@0.1.0" = fetchurl {
     url = "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz";
     hash = "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==";
diff --git a/packages/api/src/routers/agent.ts b/packages/api/src/routers/agent.ts
deleted file mode 100644
index ed6045ff..00000000
--- a/packages/api/src/routers/agent.ts
+++ /dev/null
@@ -1,467 +0,0 @@
-import { TRPCError } from "@trpc/server";
-import { z } from "zod/v4";
-
-import { createTRPCRouter, publicProcedure } from "../trpc";
-
-/**
- * Schema definitions for agent/project types
- */
-const ProjectSchema = z.object({
-  path: z.string(),
-  name: z.string(),
-  last_opened: z.string(),
-  active: z.boolean(),
-});
-
-const ProjectListResponseSchema = z.object({
-  projects: z.array(ProjectSchema),
-});
-
-const ProjectCurrentResponseSchema = z.object({
-  has_project: z.boolean(),
-  project: ProjectSchema.nullable(),
-});
-
-const ProjectOpenResponseSchema = z.object({
-  success: z.boolean(),
-  project: ProjectSchema,
-  devshell: z
-    .object({
-      in_devshell: z.boolean(),
-      has_devshell_env: z.boolean(),
-      error: z.string().optional(),
-    })
-    .optional(),
-});
-
-const ProjectValidateResponseSchema = z.object({
-  valid: z.boolean(),
-  error: z.string().optional(),
-  message: z.string().optional(),
-});
-
-const AgentHealthSchema = z.object({
-  status: z.string(),
-  has_project: z.boolean(),
-  project_root: z.string().optional(),
-});
-
-const AWSSessionStatusSchema = z.object({
-  enabled: z.boolean(),
-  valid: z.boolean(),
-  expires_at: z.string().optional(),
-  expires_in: z.string().optional(),
-  profile_arn: z.string().optional(),
-  role_arn: z.string().optional(),
-  region: z.string().optional(),
-  error: z.string().optional(),
-  has_credentials: z.boolean(),
-});
-
-const CertificateStatusSchema = z.object({
-  enabled: z.boolean(),
-  valid: z.boolean(),
-  expires_at: z.string().optional(),
-  expires_in: z.string().optional(),
-  subject: z.string().optional(),
-  issuer: z.string().optional(),
-  cert_path: z.string().optional(),
-  error: z.string().optional(),
-  ca_reachable: z.boolean(),
-  ca_url: z.string().optional(),
-});
-
-const SecurityStatusSchema = z.object({
-  aws: AWSSessionStatusSchema,
-  certificate: CertificateStatusSchema,
-});
-
-const ConfigResponseSchema = z.object({
-  config: z.record(z.string(), z.unknown()),
-  last_updated: z.string(),
-  cached: z.boolean().optional(),
-  refreshed: z.boolean().optional(),
-});
-
-/**
- * Helper to build agent base URL from config
- * In a real setup, this would come from environment or context
- */
-function getAgentBaseUrl(host = "localhost", port = 9876): string {
-  return `http://${host}:${port}`;
-}
-
-/**
- * Helper to make authenticated requests to the agent
- */
-/**
- * Agent API response wrapper type
- */
-type AgentApiResponse<T> = {
-  success: boolean;
-  data?: T;
-  error?: string;
-};
-
-async function agentFetch<T>(
-  path: string,
-  options: {
-    method?: "GET" | "POST" | "DELETE";
-    body?: unknown;
-    token?: string;
-    host?: string;
-    port?: number;
-  } = {},
-): Promise<T> {
-  const { method = "GET", body, token, host, port } = options;
-  const baseUrl = getAgentBaseUrl(host, port);
-
-  const headers: Record<string, string> = {};
-  if (body) {
-    headers["Content-Type"] = "application/json";
-  }
-  if (token) {
-    headers["X-Stackpanel-Token"] = token;
-  }
-
-  const res = await fetch(`${baseUrl}${path}`, {
-    method,
-    headers,
-    body: body ? JSON.stringify(body) : undefined,
-  });
-
-  if (!res.ok) {
-    const errorData = (await res.json().catch(() => ({}))) as {
-      message?: string;
-      error?: string;
-    };
-    throw new TRPCError({
-      code: "BAD_REQUEST",
-      message:
-        errorData.message ||
-        errorData.error ||
-        `Agent request failed: ${res.status}`,
-    });
-  }
-
-  const json = (await res.json()) as AgentApiResponse<T> | T;
-
-  // Agent API wraps responses in { success: true, data: ... }
-  // Unwrap if needed
-  if (json && typeof json === "object" && "success" in json && "data" in json) {
-    const wrapped = json as AgentApiResponse<T>;
-    if (!wrapped.success) {
-      throw new TRPCError({
-        code: "BAD_REQUEST",
-        message: wrapped.error || "Agent request failed",
-      });
-    }
-    return wrapped.data as T;
-  }
-
-  return json as T;
-}
-
-/**
- * Agent router for project management and agent communication
- */
-export const agentRouter = createTRPCRouter({
-  /**
-   * Check agent health/availability (public, no auth required)
-   */
-  health: publicProcedure
-    .input(
-      z
-        .object({
-          host: z.string().default("localhost"),
-          port: z.number().default(9876),
-        })
-        .optional(),
-    )
-    .query(async ({ input }) => {
-      const host = input?.host ?? "localhost";
-      const port = input?.port ?? 9876;
-
-      try {
-        const data = await agentFetch<z.infer<typeof AgentHealthSchema>>(
-          "/health",
-          { host, port },
-        );
-        return {
-          available: true,
-          ...data,
-        };
-      } catch {
-        return {
-          available: false,
-          status: "unavailable",
-          has_project: false,
-        };
-      }
-    }),
-
-  /**
-   * List all known projects (public endpoint on agent)
-   */
-  listProjects: publicProcedure
-    .input(
-      z
-        .object({
-          host: z.string().default("localhost"),
-          port: z.number().default(9876),
-        })
-        .optional(),
-    )
-    .query(async ({ input }) => {
-      const host = input?.host ?? "localhost";
-      const port = input?.port ?? 9876;
-
-      const data = await agentFetch<z.infer<typeof ProjectListResponseSchema>>(
-        "/api/project/list",
-        { host, port },
-      );
-      return data.projects;
-    }),
-
-  /**
-   * Get current active project (public endpoint on agent)
-   */
-  currentProject: publicProcedure
-    .input(
-      z
-        .object({
-          host: z.string().default("localhost"),
-          port: z.number().default(9876),
-        })
-        .optional(),
-    )
-    .query(async ({ input }) => {
-      const host = input?.host ?? "localhost";
-      const port = input?.port ?? 9876;
-
-      const data = await agentFetch<
-        z.infer<typeof ProjectCurrentResponseSchema>
-      >("/api/project/current", { host, port });
-      return data;
-    }),
-
-  /**
-   * Open/switch to a project (requires auth token)
-   */
-  openProject: publicProcedure
-    .input(
-      z.object({
-        path: z.string().min(1, "Project path is required"),
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .mutation(async ({ input }) => {
-      const { path, token, host, port } = input;
-
-      const data = await agentFetch<z.infer<typeof ProjectOpenResponseSchema>>(
-        "/api/project/open",
-        {
-          method: "POST",
-          body: { path },
-          token,
-          host,
-          port,
-        },
-      );
-      return data;
-    }),
-
-  /**
-   * Close the current project (requires auth token)
-   */
-  closeProject: publicProcedure
-    .input(
-      z.object({
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .mutation(async ({ input }) => {
-      const { token, host, port } = input;
-
-      await agentFetch<{ success: boolean }>("/api/project/close", {
-        method: "POST",
-        token,
-        host,
-        port,
-      });
-      return { success: true };
-    }),
-
-  /**
-   * Validate a project path (requires auth token)
-   */
-  validateProject: publicProcedure
-    .input(
-      z.object({
-        path: z.string().min(1, "Project path is required"),
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .mutation(async ({ input }) => {
-      const { path, token, host, port } = input;
-
-      const data = await agentFetch<
-        z.infer<typeof ProjectValidateResponseSchema>
-      >("/api/project/validate", {
-        method: "POST",
-        body: { path },
-        token,
-        host,
-        port,
-      });
-      return data;
-    }),
-
-  /**
-   * Remove a project from the known projects list (requires auth token)
-   */
-  removeProject: publicProcedure
-    .input(
-      z.object({
-        path: z.string().min(1, "Project path is required"),
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .mutation(async ({ input }) => {
-      const { path, token, host, port } = input;
-
-      await agentFetch<{ success: boolean }>(
-        `/api/project/remove?path=${encodeURIComponent(path)}`,
-        {
-          method: "DELETE",
-          token,
-          host,
-          port,
-        },
-      );
-      return { success: true };
-    }),
-
-  /**
-   * Get the current Stackpanel config (may be cached)
-   */
-  getConfig: publicProcedure
-    .input(
-      z.object({
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-        refresh: z.boolean().default(false),
-      }),
-    )
-    .query(async ({ input }) => {
-      const { token, host, port, refresh } = input;
-      const url = refresh ? "/api/nix/config?refresh=true" : "/api/nix/config";
-
-      const data = await agentFetch<z.infer<typeof ConfigResponseSchema>>(url, {
-        token,
-        host,
-        port,
-      });
-      return data;
-    }),
-
-  /**
-   * Force refresh the Stackpanel config by re-evaluating the flake
-   */
-  refreshConfig: publicProcedure
-    .input(
-      z.object({
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .mutation(async ({ input }) => {
-      const { token, host, port } = input;
-
-      const data = await agentFetch<z.infer<typeof ConfigResponseSchema>>(
-        "/api/nix/config",
-        {
-          method: "POST",
-          token,
-          host,
-          port,
-        },
-      );
-      return data;
-    }),
-
-  /**
-   * Get combined security status (AWS session and certificate)
-   */
-  getSecurityStatus: publicProcedure
-    .input(
-      z.object({
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .query(async ({ input }) => {
-      const { token, host, port } = input;
-
-      const data = await agentFetch<z.infer<typeof SecurityStatusSchema>>(
-        "/api/security/status",
-        { token, host, port },
-      );
-      return data;
-    }),
-
-  /**
-   * Get AWS session status only
-   */
-  getAWSStatus: publicProcedure
-    .input(
-      z.object({
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .query(async ({ input }) => {
-      const { token, host, port } = input;
-
-      const data = await agentFetch<z.infer<typeof AWSSessionStatusSchema>>(
-        "/api/security/aws",
-        { token, host, port },
-      );
-      return data;
-    }),
-
-  /**
-   * Get certificate status only
-   */
-  getCertificateStatus: publicProcedure
-    .input(
-      z.object({
-        token: z.string().min(1, "Agent token is required"),
-        host: z.string().default("localhost"),
-        port: z.number().default(9876),
-      }),
-    )
-    .query(async ({ input }) => {
-      const { token, host, port } = input;
-
-      const data = await agentFetch<z.infer<typeof CertificateStatusSchema>>(
-        "/api/security/certificate",
-        { token, host, port },
-      );
-      return data;
-    }),
-});
-
-export type AgentRouter = typeof agentRouter;
diff --git a/packages/api/src/routers/index.ts b/packages/api/src/routers/index.ts
index 5a9b72de..07997f94 100644
--- a/packages/api/src/routers/index.ts
+++ b/packages/api/src/routers/index.ts
@@ -1,10 +1,8 @@
 import { createTRPCRouter } from "../trpc";
-import { agentRouter } from "./agent";
 import { alchemyStateRouter } from "./alchemy-state";
 import { waitlistRouter } from "./waitlist";
 
 export const appRouter = createTRPCRouter({
-  agent: agentRouter,
   alchemyState: alchemyStateRouter,
   waitlist: waitlistRouter,
 });
diff --git a/packages/proto/package.json b/packages/proto/package.json
index 17bd5e64..b12922b3 100644
--- a/packages/proto/package.json
+++ b/packages/proto/package.json
@@ -22,6 +22,10 @@
       "types": "./gen/ts/agent-AgentService_connectquery.d.ts",
       "import": "./gen/ts/agent-AgentService_connectquery.js"
     },
+    "./agent/v1/*": {
+      "types": "./gen/ts/stackpanel/agent/v1/*_pb.d.ts",
+      "import": "./gen/ts/stackpanel/agent/v1/*_pb.js"
+    },
     "./apps": {
       "types": "./gen/ts/apps.ts",
       "import": "./gen/ts/apps.ts"