@aident-ai/cli 0.3.0 → 0.3.1-rc.0

package/dist/cli.mjs

@@ -3354,7 +3354,7 @@ import { mkdir as mkdir2 } from "node:fs/promises";
 import { dirname as dirname2, posix, resolve as resolve2, sep } from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { createGunzip } from "node:zlib";
+import { createGunzip, gzipSync } from "node:zlib";
 
 // ../../node_modules/tar-stream/index.js
 var $extract = require_extract();
@@ -7191,11 +7191,13 @@ var AgentSkillBundleVersionSchema = stringType().regex(/^[0-9]+\.[0-9]+\.[0-9]+(
 var AgentSkillBundleSha256Schema = stringType().regex(/^[a-f0-9]{64}$/);
 var AgentSkillBundleGitShaSchema = stringType().regex(/^[a-f0-9]{40}$/);
 var AgentSkillBundleRightsBasisSchema = nativeEnumType(AgentSkillBundleRightsBasis);
+var AgentSkillBundleSourcePathSchema = stringType().min(1).max(300).regex(/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/).refine((value) => value.split("/").every((segment) => segment !== "." && segment !== ".."));
 var AgentSkillBundlePublishManifestSchema = objectType({
   name: AgentSkillBundleNameSchema,
   version: AgentSkillBundleVersionSchema,
   sourceOwner: stringType().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/).max(39).refine((value) => !value.includes("--")),
   sourceRepository: stringType().regex(/^[A-Za-z0-9_.][A-Za-z0-9_.-]{0,99}$/).refine((value) => value !== "." && value !== ".."),
+  sourcePath: AgentSkillBundleSourcePathSchema.optional(),
   sourceCommit: AgentSkillBundleGitShaSchema,
   sourceTree: AgentSkillBundleGitShaSchema,
   expectedSha256: AgentSkillBundleSha256Schema,
@@ -7387,25 +7389,9 @@ async function installAgentSkillBundle(descriptorValue, options = {}, injected =
   const descriptor = AgentSkillBundleInstallDescriptorSchema.parse(descriptorValue);
   const home = options.home ?? homedir2();
   const env = options.env ?? process.env;
-  const stateRoot = join3(home, ".aident", "skills", "internal", descriptor.name);
-  const releasesRoot = join3(stateRoot, "releases");
-  const releaseDirectory = join3(releasesRoot, descriptor.artifactSha256);
-  await mkdir3(stateRoot, { recursive: true, mode: 448 });
-  const lock = await tryAcquireDirectoryLock(join3(stateRoot, "install.lock"));
-  if (!lock)
-    throw new Error(`Another ${descriptor.name} installation is already running`);
-  try {
-    if (!await pathExists(releaseDirectory)) {
-      const archive = await downloadArchive(descriptor, injected.fetch ?? fetch);
-      await materializeRelease(archive, descriptor, releasesRoot, releaseDirectory);
-    } else {
-      const existingRelease = await lstat2(releaseDirectory);
-      if (!existingRelease.isDirectory()) {
-        throw new Error(`Existing agent Skill release is not a directory: ${releaseDirectory}`);
-      }
-      await assertInstalledSkillIdentity(releaseDirectory, descriptor.name);
-    }
-    const targets = await reconcileTargets(descriptor.name, releaseDirectory, releasesRoot, home, env);
+  return withInstallLock(descriptor.name, home, async () => {
+    const { releaseDirectory } = await prepareRelease(descriptor, home, injected.fetch ?? fetch);
+    const targets = await reconcileTargets(descriptor.name, releaseDirectory, dirname3(releaseDirectory), home, env);
     return {
       name: descriptor.name,
       version: descriptor.version,
@@ -7414,6 +7400,37 @@ async function installAgentSkillBundle(descriptorValue, options = {}, injected =
       success: targets.every((target) => target.status !== "conflict" /* Conflict */ && target.status !== "failed" /* Failed */),
       targets
     };
+  });
+}
+async function prepareAgentSkillBundleRelease(descriptorValue, options = {}, injected = {}) {
+  const descriptor = AgentSkillBundleInstallDescriptorSchema.parse(descriptorValue);
+  const home = options.home ?? homedir2();
+  return withInstallLock(descriptor.name, home, () => prepareRelease(descriptor, home, injected.fetch ?? fetch));
+}
+async function prepareRelease(descriptor, home, fetchImpl) {
+  const stateRoot = join3(home, ".aident", "skills", "internal", descriptor.name);
+  const releasesRoot = join3(stateRoot, "releases");
+  const releaseDirectory = join3(releasesRoot, descriptor.artifactSha256);
+  if (!await pathExists(releaseDirectory)) {
+    const archive = await downloadArchive(descriptor, fetchImpl);
+    await materializeRelease(archive, descriptor, releasesRoot, releaseDirectory);
+  } else {
+    const existingRelease = await lstat2(releaseDirectory);
+    if (!existingRelease.isDirectory()) {
+      throw new Error(`Existing agent Skill release is not a directory: ${releaseDirectory}`);
+    }
+    await assertInstalledSkillIdentity(releaseDirectory, descriptor.name);
+  }
+  return { descriptor, releaseDirectory };
+}
+async function withInstallLock(name, home, run) {
+  const stateRoot = join3(home, ".aident", "skills", "internal", name);
+  await mkdir3(stateRoot, { recursive: true, mode: 448 });
+  const lock = await tryAcquireDirectoryLock(join3(stateRoot, "install.lock"));
+  if (!lock)
+    throw new Error(`Another ${name} installation is already running`);
+  try {
+    return await run();
   } finally {
     await lock.release();
   }
@@ -7689,7 +7706,7 @@ function readLine(prompt, options = {}) {
 var CLIENT_NAME = "aident-cli";
 var LOOPBACK_HOST = "127.0.0.1";
 var LOGIN_OPEN_TIMEOUT_MS = 90 * 1000;
-var LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS = 5 * 60 * 1000;
+var LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS = 30 * 60 * 1000;
 var LOGIN_OPENED_MESSAGE = `User opened the Aident login window. They have ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 60000} minutes to finish; if it fails, run \`aident login --oob\`, share the URL, and ask for the verification code.`;
 async function login(options) {
   const baseUrl = options.baseUrl.replace(/\/+$/, "");
@@ -8167,7 +8184,7 @@ function getConfigFile() {
 function getConfigFileForHome(home) {
   return join4(getAidentDir(home), "config.json");
 }
-var DEFAULT_BASE_URL = "https://loadout.aident.ai"?.trim() || "https://loadout.aident.ai";
+var DEFAULT_BASE_URL = "https://rc.loadout.aident.ai"?.trim() || "https://loadout.aident.ai";
 var CONFIG_KEYS = ["baseUrl", "packages"];
 async function readConfig(configFile = getConfigFile()) {
   try {
@@ -8460,7 +8477,7 @@ function serializeLoadoutSkillPackage(skillPackage) {
 }
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.3.1-rc.0";
 var DESKTOP_VERSION = process.env.AIDENT_DESKTOP_VERSION?.trim() || undefined;
 var DESKTOP_CHANNEL = parseDesktopChannel(process.env.AIDENT_DESKTOP_CHANNEL);
 function parseDesktopChannel(value) {
@@ -9353,7 +9370,7 @@ var LoadoutFavoriteSkillsUpdateSchema = objectType({
   syncRequired: booleanType()
 }).strict();
 function getLoadoutFavoriteSkillsStateToken(skills) {
-  const state = skills.map(({ name, artifactVersionId }) => ({ name, artifactVersionId })).sort((left, right) => left.name.localeCompare(right.name));
+  const state = skills.map(({ name, artifactVersionId, deliveryRevision }) => ({ name, artifactVersionId, deliveryRevision })).sort((left, right) => left.name.localeCompare(right.name));
   return createHash3("sha256").update(JSON.stringify(state)).digest("hex");
 }
 
@@ -9517,10 +9534,11 @@ var KNOWN_CLEAN_LOADOUT_SKILL_REQUIRED_FILE_GIT_BLOB_SHA1 = {
     }
   ]
 };
-async function fetchLoadoutSkillMetadata(baseUrl) {
+async function fetchLoadoutSkillMetadata(baseUrl, signal) {
   const metadataUrl = `${baseUrl.replace(/\/+$/, "")}/.well-known/loadout-skill.json`;
   const res = await fetch(metadataUrl, {
     method: "GET",
+    signal,
     headers: {
       "User-Agent": `@aident-ai/cli/${VERSION}`,
       [AIDENT_UPDATE_PROTOCOL_HEADER]: AIDENT_UPDATE_PROTOCOL_VERSION
@@ -10090,7 +10108,7 @@ function isExpired(creds) {
 
 // src/loadoutFavoriteSkills.ts
 import { createHash as createHash5 } from "node:crypto";
-import { lstat as lstat5, mkdir as mkdir8, readFile as readFile8, readlink, rename as rename4, rm as rm3, symlink as symlink3, writeFile as writeFile6 } from "node:fs/promises";
+import { cp, lstat as lstat5, mkdir as mkdir8, readFile as readFile8, readlink, rename as rename4, rm as rm3, symlink as symlink3, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path from "node:path";
 
@@ -10169,6 +10187,8 @@ function assertPackage(pkg) {
   }
   if (packageBytes > LOADOUT_SKILL_MAX_PACKAGE_BYTES)
     throw new Error(`Package is too large: ${pkg.name}`);
+  if (pkg.bundle)
+    AgentSkillBundleInstallDescriptorSchema.parse(pkg.bundle);
 }
 function quoteYaml(value) {
   return JSON.stringify(value);
@@ -10211,7 +10231,7 @@ async function readManifest(home, env) {
       throw new Error("Unsupported manifest");
     const harnessRoots = new Set(getHarnessHosts(home, env).map(({ root }) => path.join(root, "skills")));
     for (const skill of value.skills) {
-      if (!LOADOUT_SKILL_NAME_PATTERN.test(skill.name) || !isCanonicalUuid(skill.artifactVersionId) || skill.displayName !== undefined && typeof skill.displayName !== "string" || skill.summary !== undefined && typeof skill.summary !== "string" || !/^loadout-[a-z0-9-]+-[0-9a-f]{8}$/.test(skill.commandName) || skill.installPath !== path.join(getCanonicalRoot(home, env), skill.commandName) || skill.linkPaths.some((linkPath) => !harnessRoots.has(path.dirname(linkPath)) || path.basename(linkPath) !== skill.commandName)) {
+      if (!LOADOUT_SKILL_NAME_PATTERN.test(skill.name) || !isCanonicalUuid(skill.artifactVersionId) || skill.displayName !== undefined && typeof skill.displayName !== "string" || skill.summary !== undefined && typeof skill.summary !== "string" || skill.deliveryRevision !== undefined && !/^[a-f0-9]{64}$/.test(skill.deliveryRevision) || !/^loadout-[a-z0-9-]+-[0-9a-f]{8}$/.test(skill.commandName) || skill.installPath !== path.join(getCanonicalRoot(home, env), skill.commandName) || skill.linkPaths.some((linkPath) => !harnessRoots.has(path.dirname(linkPath)) || path.basename(linkPath) !== skill.commandName)) {
         throw new Error("Invalid favorite Skills ownership manifest");
       }
     }
@@ -10245,7 +10265,11 @@ async function removeOwnedSkill(skill) {
   if (await pathExists3(skill.installPath))
     await rm3(skill.installPath, { recursive: true });
 }
-async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = process.env) {
+async function writeBundlePackage(directory, pkg, releaseDirectory) {
+  await cp(releaseDirectory, directory, { recursive: true });
+  await writeFile6(path.join(directory, LOADOUT_SKILL_ENTRYPOINT), entrypointContent(pkg, await readFile8(path.join(releaseDirectory, LOADOUT_SKILL_ENTRYPOINT), "utf8")));
+}
+async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = process.env, injected = {}) {
   const manifest = await readManifest(home, env);
   const previousByName = new Map(manifest.skills.map((skill) => [skill.name, skill]));
   const desiredNames = new Set(payload.packages.map((pkg) => pkg.name));
@@ -10260,6 +10284,12 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
   if (payload.unavailable.some((name) => desiredNames.has(name))) {
     throw new Error("A favorite Skill cannot be both available and unavailable");
   }
+  const preparedBundles = new Map;
+  for (const pkg of payload.packages) {
+    if (!pkg.bundle)
+      continue;
+    preparedBundles.set(pkg.name, await (injected.prepareBundleRelease ?? prepareAgentSkillBundleRelease)(pkg.bundle, { home, env }));
+  }
   const nextSkills = [];
   const result = {
     installed: [],
@@ -10301,21 +10331,26 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
       continue;
     }
     const allLinksExist = (await Promise.all(linkPaths.map(pathExists3))).every(Boolean);
-    if (previous?.artifactVersionId === pkg.artifactVersionId && previous.displayName === pkg.displayName && previous.summary === pkg.summary && previous.installPath === installPath && previous.linkPaths.length === linkPaths.length && previous.linkPaths.every((linkPath) => linkPaths.includes(linkPath)) && await pathExists3(installPath) && allLinksExist) {
+    if (previous?.artifactVersionId === pkg.artifactVersionId && previous.displayName === pkg.displayName && previous.summary === pkg.summary && previous.deliveryRevision === pkg.bundle?.artifactSha256 && previous.installPath === installPath && previous.linkPaths.length === linkPaths.length && previous.linkPaths.every((linkPath) => linkPaths.includes(linkPath)) && await pathExists3(installPath) && allLinksExist) {
       result.unchanged.push(pkg.name);
       nextSkills.push(previous);
       continue;
     }
+    const preparedBundle = preparedBundles.get(pkg.name);
     const temporaryPath = `${installPath}.${process.pid}.tmp`;
     const backupPath = `${installPath}.${process.pid}.backup`;
     await mkdir8(getCanonicalRoot(home, env), { recursive: true });
     await rm3(temporaryPath, { recursive: true, force: true });
     await rm3(backupPath, { recursive: true, force: true });
-    await mkdir8(temporaryPath, { recursive: true });
-    for (const file of pkg.files) {
-      const destination = path.join(temporaryPath, ...file.path.split("/"));
-      await mkdir8(path.dirname(destination), { recursive: true });
-      await writeFile6(destination, file.path === LOADOUT_SKILL_ENTRYPOINT ? entrypointContent(pkg, file.content) : file.content);
+    if (preparedBundle) {
+      await writeBundlePackage(temporaryPath, pkg, preparedBundle.releaseDirectory);
+    } else {
+      await mkdir8(temporaryPath, { recursive: true });
+      for (const file of pkg.files) {
+        const destination = path.join(temporaryPath, ...file.path.split("/"));
+        await mkdir8(path.dirname(destination), { recursive: true });
+        await writeFile6(destination, file.path === LOADOUT_SKILL_ENTRYPOINT ? entrypointContent(pkg, file.content) : file.content);
+      }
     }
     const createdLinkPaths = [];
     let backedUp = false;
@@ -10350,7 +10385,8 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
       summary: pkg.summary,
       commandName: nextCommandName,
       installPath,
-      linkPaths
+      linkPaths,
+      ...pkg.bundle ? { deliveryRevision: pkg.bundle.artifactSha256 } : {}
     });
     (previous ? result.updated : result.installed).push(pkg.name);
   }
@@ -11357,7 +11393,7 @@ async function readBoundedResponseBody(response, expectedByteLength, maximumByte
 
 // src/minisign.ts
 import { createHash as createHash7, createPublicKey, verify } from "node:crypto";
-var ACTIVE_PUBLIC_KEYS = JSON.parse('{"production-1":"RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"}');
+var ACTIVE_PUBLIC_KEYS = JSON.parse('{"aident-desktop-release-2026-08-v2":"RWSuGigRGuwWblBdVlTya0xk4E3OlM2YOWrxndkGuO5ZN3tq5JdpF45a"}');
 var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
 function verifyMinisign(bytes, signatureText, signingKeyId) {
   const encodedKey = ACTIVE_PUBLIC_KEYS[signingKeyId];
@@ -11395,7 +11431,7 @@ import { chmod, lstat as lstat6, mkdir as mkdir9, open, readFile as readFile10,
 import { dirname as dirname8, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve4 } from "node:path";
 import { promisify } from "node:util";
 var execFile2 = promisify(execFileCallback);
-var windowsAccount;
+var windowsAccountSid;
 async function readFileIfPresent(path) {
   try {
     const entry = await lstat6(path);
@@ -11471,17 +11507,23 @@ function hasCode3(error, code) {
 async function protectWindowsPath(path, directory) {
   if (process.platform !== "win32")
     return;
-  const account = await getWindowsAccount();
-  await execFile2("icacls.exe", [path, "/inheritance:r", "/grant:r", `${account}:${directory ? "(OI)(CI)" : ""}F`]);
+  const sid = await getWindowsAccountSid();
+  await execFile2("icacls.exe", [path, "/inheritance:r", "/grant:r", `*${sid}:${directory ? "(OI)(CI)" : ""}F`]);
 }
-async function getWindowsAccount() {
-  windowsAccount ??= execFile2("whoami.exe").then(({ stdout }) => stdout.trim());
-  const pending = windowsAccount;
+function parseWindowsAccountSid(output) {
+  const match = output.toString("latin1").match(/,"(S-1-\d+(?:-\d+)+)"\s*$/);
+  if (!match)
+    throw new Error("Windows account SID is unavailable");
+  return match[1];
+}
+async function getWindowsAccountSid() {
+  windowsAccountSid ??= execFile2("whoami.exe", ["/user", "/fo", "csv", "/nh"], { encoding: "buffer" }).then(({ stdout }) => parseWindowsAccountSid(stdout));
+  const pending = windowsAccountSid;
   try {
     return await pending;
   } catch (error) {
-    if (windowsAccount === pending)
-      windowsAccount = undefined;
+    if (windowsAccountSid === pending)
+      windowsAccountSid = undefined;
     throw error;
   }
 }
@@ -11803,22 +11845,51 @@ import { execFile as execFileCallback2 } from "node:child_process";
 import { constants as constants3 } from "node:fs";
 import { access as access2, realpath as realpath5 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { basename as basename3, delimiter as delimiter2, isAbsolute as isAbsolute5, join as join11 } from "node:path";
+import { basename as basename3, delimiter as delimiter2, isAbsolute as isAbsolute5, join as join11, win32 as win323 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFile3 = promisify2(execFileCallback2);
 var SUPPORTED_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var WINDOWS_ENV_KEYS = new Map([
+  ["path", "PATH"],
+  ["systemroot", "SystemRoot"],
+  ["comspec", "ComSpec"]
+]);
+var PROBE_TIMEOUT_DETAIL = "Windows CLI verification timed out; retry after the machine finishes starting up";
+var WINDOWS_PROBE_CLEANUP_TIMEOUT_MS = 2000;
 async function inspectAidentCliEntrypoint(home = homedir8(), env = process.env, platform = process.platform, injected = {}) {
+  if (platform === "win32") {
+    env = Object.fromEntries(Object.entries(env).map(([key, value]) => [WINDOWS_ENV_KEYS.get(key.toLowerCase()) ?? key, value]));
+  }
   const resolveNativePath = injected.resolveNativePath ?? (async (homeDirectory) => (await readActiveNativeInstallation(homeDirectory, getActiveCliExecutablePath(env)))?.receipt.cliPath ?? null);
-  const [active, nativePath] = await Promise.all([
-    (injected.resolveActiveCommand ?? resolveActiveAidentCommand)(env, platform),
+  const probeTimeoutMs = platform === "win32" ? injected.probeTimeoutMs ?? 1e4 : undefined;
+  if (probeTimeoutMs !== undefined && probeTimeoutMs <= 0)
+    throw new RangeError("Windows probe timeout must be positive");
+  const commandDeadline = probeTimeoutMs ? AbortSignal.timeout(probeTimeoutMs * 2 - Math.min(probeTimeoutMs, WINDOWS_PROBE_CLEANUP_TIMEOUT_MS)) : undefined;
+  const runProbe = injected.execFile ?? ((file, args, env, platform) => runFile(file, args, env, platform, commandDeadline, probeTimeoutMs, injected.spawnProbe));
+  const probe = async (operation) => {
+    let timedOut = false;
+    const executeFile = async (file, args, env, platform) => {
+      try {
+        return await runProbe(file, args, env, platform);
+      } catch (error) {
+        if (platform === "win32" && error instanceof Error && error.name === "TimeoutError")
+          timedOut = true;
+        throw error;
+      }
+    };
+    return { value: await operation(executeFile), timedOut };
+  };
+  const [resolution, nativePath] = await Promise.all([
+    probe((executeFile) => injected.resolveActiveCommand ? injected.resolveActiveCommand(env, platform) : resolveActiveAidentCommand(env, platform, executeFile)),
     resolveNativePath(home)
   ]);
+  const active = resolution.value;
   if (!active) {
     return {
       ok: false,
-      owner: "missing",
+      owner: resolution.timedOut ? "unknown" /* Unknown */ : "missing",
       ...nativePath ? { nativePath } : {},
-      detail: nativePath ? "The bundled Aident CLI is installed but the aident command is not available on PATH" : "The aident command is not available on PATH"
+      detail: resolution.timedOut ? PROBE_TIMEOUT_DETAIL : nativePath ? "The bundled Aident CLI is installed but the aident command is not available on PATH" : "The aident command is not available on PATH"
     };
   }
   const resolveRealpath = injected.realpath ?? realpath5;
@@ -11826,7 +11897,7 @@ async function inspectAidentCliEntrypoint(home = homedir8(), env = process.env,
     resolveRealpath(active.path).catch(() => active.path),
     nativePath ? resolveRealpath(nativePath).catch(() => nativePath) : null
   ]);
-  const version = await (injected.readVersion ?? readAidentCliVersion)(active.path, active.env);
+  const { value: version, timedOut: versionTimedOut } = await probe((executeFile) => injected.readVersion ? injected.readVersion(active.path, active.env) : readAidentCliVersion(active.path, active.env, platform, executeFile));
   const requiredVersion = injected.requiredVersion ?? VERSION;
   const current = version !== null && isAidentSemver(version) && compareAidentSemver(version, requiredVersion) >= 0;
   if (nativeRealpath && activeRealpath === nativeRealpath) {
@@ -11836,42 +11907,70 @@ async function inspectAidentCliEntrypoint(home = homedir8(), env = process.env,
       ...version ? { version } : {},
       activePath: active.path,
       nativePath,
-      detail: version ? current ? "The native Aident CLI is the active command" : `The active Aident CLI v${version} must be updated to v${requiredVersion} or newer before onboarding` : "The native Aident CLI could not report its version"
+      detail: version ? current ? "The native Aident CLI is the active command" : `The active Aident CLI v${version} must be updated to v${requiredVersion} or newer before onboarding` : versionTimedOut ? PROBE_TIMEOUT_DETAIL : "The native Aident CLI could not report its version"
     };
   }
   const detectOwnership = injected.detectOwnership ?? detectCliInstallOwnership;
-  const ownership = await detectOwnership(active.path, home, {
+  const { value: ownership, timedOut: ownershipTimedOut } = await probe((executeFile) => detectOwnership(active.path, home, {
     platform,
-    execFile: (file, args) => runFile(file, args, active.env),
+    execFile: (file, args) => executeFile(file, args, active.env, platform),
     resolveExecutable: (file) => resolveExecutable(file, active.env, platform)
-  });
+  }));
   const packageManaged = [
     "npm" /* Npm */,
     "pnpm" /* Pnpm */,
     "bun" /* Bun */,
     "volta" /* Volta */
   ].includes(ownership.method);
+  let detail = "The active Aident CLI owner could not be verified";
+  if (ownership.method === "ephemeral" /* Ephemeral */) {
+    detail = "An ephemeral Aident CLI cannot be used as the persistent global entrypoint";
+  } else if (packageManaged) {
+    if (nativePath) {
+      detail = `The ${ownership.method}-managed Aident CLI is shadowing the installed native command; reinstall Aident to replace it`;
+    } else if (current) {
+      detail = `The Aident CLI is managed by ${ownership.method}`;
+    } else {
+      detail = `Run aident update --cli-only to update the active ${ownership.method}-managed CLI to v${requiredVersion} or newer`;
+    }
+  }
+  if (ownership.method === "unknown" /* Unknown */ && ownershipTimedOut || versionTimedOut && !nativePath && ownership.method !== "ephemeral" /* Ephemeral */) {
+    detail = PROBE_TIMEOUT_DETAIL;
+  }
   return {
     ok: packageManaged && current && !nativePath,
     owner: ownership.method,
     ...version ? { version } : {},
     activePath: active.path,
     ...nativePath ? { nativePath } : {},
-    detail: packageManaged ? nativePath ? `The ${ownership.method}-managed Aident CLI is shadowing the installed native command; reinstall Aident to replace it` : current ? `The Aident CLI is managed by ${ownership.method}` : `Run aident update --cli-only to update the active ${ownership.method}-managed CLI to v${requiredVersion} or newer` : ownership.method === "ephemeral" /* Ephemeral */ ? "An ephemeral Aident CLI cannot be used as the persistent global entrypoint" : "The active Aident CLI owner could not be verified"
+    detail
   };
 }
-async function resolveActiveAidentCommand(env, platform) {
+async function resolveActiveAidentCommand(env, platform, executeFile) {
   if (platform === "win32") {
-    const output = await execFile3("where.exe", ["aident"], { env, windowsHide: true }).catch(() => null);
-    const path = output?.stdout.split(/\r?\n/).find((line) => isAbsolute5(line.trim()))?.trim();
-    return path ? { path, env } : null;
+    const command = "$ErrorActionPreference = 'Stop'; $env:Path = ([Environment]::GetEnvironmentVariable('Path', 'Machine'), [Environment]::GetEnvironmentVariable('Path', 'User') | Where-Object { $_ }) -join ';'; $active = Get-Command aident -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1; $json = @{ path = $active.Source; pathValue = $env:Path } | ConvertTo-Json -Compress; [regex]::Replace($json, '[^\\x00-\\x7F]', { param($match) '\\u{0:x4}' -f [int][char]$match.Value })";
+    try {
+      const output = await executeFile(win323.join(env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), ["-NoProfile", "-NonInteractive", "-Command", command], env, platform);
+      const resolved = JSON.parse(output.stdout);
+      if (!resolved || typeof resolved.path !== "string" || !win323.isAbsolute(resolved.path) || typeof resolved.pathValue !== "string") {
+        return null;
+      }
+      const inherited = Object.fromEntries(Object.entries(env).filter(([key]) => key.toLowerCase() !== "path"));
+      return { path: resolved.path, env: { ...inherited, PATH: resolved.pathValue } };
+    } catch (error) {
+      if (error instanceof Error && error.name === "TimeoutError")
+        return null;
+      const output = await executeFile(win323.join(env.SystemRoot ?? "C:\\Windows", "System32", "where.exe"), ["aident"], env, platform).catch(() => null);
+      const path = output?.stdout.split(/\r?\n/).find((line) => win323.isAbsolute(line.trim()))?.trim();
+      return path ? { path, env } : null;
+    }
   }
   const shell = env.SHELL && isAbsolute5(env.SHELL) ? env.SHELL : "/bin/sh";
   if (!SUPPORTED_SHELLS.has(basename3(shell)))
     return resolveFromPath(env, platform);
   const marker = "__AIDENT_ENTRYPOINT__";
   const command = `printf '${marker}%s\\n${marker}%s\\n' "$PATH" "$(command -v aident 2>/dev/null || true)"`;
-  const output = await execFile3(shell, ["-lic", command], { env }).catch(() => null);
+  const output = await executeFile(shell, ["-lic", command], env, platform).catch(() => null);
   if (!output)
     return resolveFromPath(env, platform);
   const marked = output.stdout.split(/\r?\n/).filter((line) => line.startsWith(marker)).map((line) => line.slice(marker.length));
@@ -11902,12 +12001,66 @@ async function resolveExecutable(file, env, platform) {
 async function isExecutable2(path, platform) {
   return access2(path, platform === "win32" ? constants3.F_OK : constants3.X_OK).then(() => true, () => false);
 }
-async function readAidentCliVersion(path, env) {
-  const result = await runFile(path, ["--version"], env).catch(() => null);
+async function readAidentCliVersion(path, env, platform, executeFile) {
+  const result = await executeFile(path, ["--version"], env, platform).catch(() => null);
   return result ? parseCliVersionOutput(result.stdout) : null;
 }
-function runFile(file, args, env) {
-  return execFile3(file, [...args], { env, windowsHide: true }).then(({ stdout, stderr }) => ({ stdout, stderr }));
+async function runFile(file, args, env, platform, signal, timeout, spawnProbe = execFileCallback2) {
+  const invocation = getPlatformExecFileInvocation(file, args, platform, env.ComSpec);
+  if (platform !== "win32" || !timeout) {
+    const { stdout, stderr } = await execFile3(invocation.file, invocation.args, { env, windowsHide: true });
+    return { stdout, stderr };
+  }
+  signal?.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    let cancelled = false;
+    let completed = false;
+    const child = spawnProbe(invocation.file, invocation.args, { env, windowsHide: true, encoding: "utf8" }, (error, stdout, stderr) => {
+      completed = true;
+      if (cancelled)
+        return;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", cancel);
+      if (error)
+        reject(error);
+      else
+        resolve({ stdout, stderr });
+    });
+    const cancel = () => {
+      if (cancelled)
+        return;
+      cancelled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", cancel);
+      let finished = false;
+      const finish = () => {
+        if (finished)
+          return;
+        finished = true;
+        clearTimeout(cleanupTimer);
+        child.removeListener("close", finish);
+        child.kill();
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        reject(new DOMException("Windows CLI entrypoint probe timed out", "TimeoutError"));
+      };
+      const cleanupTimeout = Math.min(timeout, WINDOWS_PROBE_CLEANUP_TIMEOUT_MS);
+      const cleanupTimer = setTimeout(finish, cleanupTimeout);
+      if (child.pid) {
+        spawnProbe(win323.join(env.SystemRoot ?? "C:\\Windows", "System32", "taskkill.exe"), ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, timeout: cleanupTimeout, encoding: "utf8" }, () => {
+          child.kill();
+          if (completed)
+            finish();
+          else
+            child.once("close", finish);
+        });
+      } else {
+        finish();
+      }
+    };
+    const timer = setTimeout(cancel, timeout);
+    signal?.addEventListener("abort", cancel, { once: true });
+  });
 }
 
 // src/harnesses/registry.ts
@@ -14632,7 +14785,8 @@ var HttpOperationPollingResultDefinitionSchema = objectType({
   path: stringType().startsWith("/"),
   idField: stringType().min(1),
   idPathParam: stringType().min(1).optional(),
-  idQueryParam: stringType().min(1).optional()
+  idQueryParam: stringType().min(1).optional(),
+  inputPathParams: arrayType(stringType().min(1)).optional()
 }).superRefine((result, ctx) => {
   if (result.idPathParam === undefined === (result.idQueryParam === undefined)) {
     ctx.addIssue({
@@ -14647,16 +14801,28 @@ var HttpOperationPollingResultDefinitionSchema = objectType({
       path: ["path"]
     });
   }
+  for (const inputPathParam of result.inputPathParams ?? []) {
+    if (!result.path.includes(`{${inputPathParam}}`)) {
+      ctx.addIssue({
+        code: ZodIssueCode.custom,
+        message: "Polling result path must include every input path parameter",
+        path: ["inputPathParams"]
+      });
+    }
+  }
 });
 var HttpOperationPollingDefinitionSchema = objectType({
   path: stringType().startsWith("/"),
   taskIdField: stringType().min(1),
   taskIdPathParam: stringType().min(1).optional(),
   taskIdQueryParam: stringType().min(1).optional(),
-  statusField: stringType().min(1),
-  pendingStatuses: arrayType(stringType().min(1)).min(1),
-  terminalStatuses: arrayType(stringType().min(1)).min(1),
+  inputPathParams: arrayType(stringType().min(1)).optional(),
+  statusField: stringType().min(1).optional(),
+  pendingStatuses: arrayType(stringType().min(1)).min(1).optional(),
+  terminalStatuses: arrayType(stringType().min(1)).min(1).optional(),
   failureStatuses: arrayType(stringType().min(1)).optional(),
+  successField: stringType().min(1).optional(),
+  failureField: stringType().min(1).optional(),
   intervalMs: numberType().int().min(HTTP_OPERATION_MIN_POLL_INTERVAL_MS),
   timeoutMs: numberType().int().min(HTTP_OPERATION_MIN_TIMEOUT_MS).max(HTTP_OPERATION_MAX_TIMEOUT_MS),
   result: HttpOperationPollingResultDefinitionSchema.optional()
@@ -14674,7 +14840,38 @@ var HttpOperationPollingDefinitionSchema = objectType({
       path: ["path"]
     });
   }
-  const terminalStatuses = new Set(polling.terminalStatuses);
+  for (const inputPathParam of polling.inputPathParams ?? []) {
+    if (!polling.path.includes(`{${inputPathParam}}`)) {
+      ctx.addIssue({
+        code: ZodIssueCode.custom,
+        message: "Polling path must include every input path parameter",
+        path: ["inputPathParams"]
+      });
+    }
+  }
+  const usesStatus = polling.statusField !== undefined;
+  const usesFields = polling.successField !== undefined || polling.failureField !== undefined;
+  if (usesStatus === usesFields) {
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "Polling must define either status fields or success and failure fields"
+    });
+  }
+  if (usesStatus && (!polling.pendingStatuses || !polling.terminalStatuses)) {
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "Status polling requires pending and terminal statuses",
+      path: ["statusField"]
+    });
+  }
+  if (usesFields && (!polling.successField || !polling.failureField)) {
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "Field polling requires success and failure fields",
+      path: ["successField"]
+    });
+  }
+  const terminalStatuses = new Set(polling.terminalStatuses ?? []);
   if (polling.failureStatuses?.some((status) => !terminalStatuses.has(status))) {
     ctx.addIssue({
       code: ZodIssueCode.custom,
@@ -16977,6 +17174,10 @@ var LOADOUT_ONBOARDING_GUIDE_MESSAGES = {
       completedTitle: "Run another task",
       description: "Choose your AI app, then enter a task.",
       exploreDescription: `Use ${LOADOUT_APPS_LABEL} for research, content, video, and more.`,
+      hostedAction: "Try the hosted agent",
+      hostedDescription: "Run a real task on your phone. No agent installation needed.",
+      hostedTitle: "Try Loadout on your phone",
+      returnToHostedResult: "Return to your hosted result",
       placeholder: "Enter a task...",
       title: "Run a task with Loadout",
       tryTool: `Explore ready-to-use ${LOADOUT_APPS_LABEL}`
@@ -17034,6 +17235,10 @@ var LOADOUT_ONBOARDING_GUIDE_MESSAGES = {
       completedTitle: "再运行一个任务",
       description: "选择你的 AI 应用，然后输入任务。",
       exploreDescription: `使用${chineseTerminology.apps}完成研究、内容、视频等任务。`,
+      hostedAction: "试用托管智能体",
+      hostedDescription: "在手机上运行真实任务，无需安装智能体。",
+      hostedTitle: "在手机上试用 Loadout",
+      returnToHostedResult: "返回托管任务结果",
       placeholder: "输入任务…",
       title: "使用 Loadout 运行任务",
       tryTool: `探索即开即用的${chineseTerminology.apps}`
@@ -17091,6 +17296,10 @@ var LOADOUT_ONBOARDING_GUIDE_MESSAGES = {
       completedTitle: "Ejecuta otra tarea",
       description: "Elige tu app de IA e introduce una tarea.",
       exploreDescription: `Usa ${LOADOUT_APPS_LABEL} para investigación, contenido, video y más.`,
+      hostedAction: "Probar el agente alojado",
+      hostedDescription: "Ejecuta una tarea real en tu móvil sin instalar nada en un agente.",
+      hostedTitle: "Prueba Loadout en tu móvil",
+      returnToHostedResult: "Volver al resultado del agente",
       placeholder: "Introduce una tarea...",
       title: "Ejecuta una tarea con Loadout",
       tryTool: `Explora ${LOADOUT_APPS_LABEL} listas para usar`
@@ -17148,6 +17357,10 @@ var LOADOUT_ONBOARDING_GUIDE_MESSAGES = {
       completedTitle: "Exécuter une autre tâche",
       description: "Choisissez votre app IA, puis saisissez une tâche.",
       exploreDescription: `Utilisez des ${LOADOUT_APPS_LABEL} pour la recherche, le contenu, la vidéo et plus encore.`,
+      hostedAction: "Essayer l’agent hébergé",
+      hostedDescription: "Exécutez une vraie tâche sur votre téléphone, sans installer d’agent.",
+      hostedTitle: "Essayez Loadout sur votre téléphone",
+      returnToHostedResult: "Revenir au résultat de l’agent",
       placeholder: "Saisissez une tâche...",
       title: "Exécuter une tâche avec Loadout",
       tryTool: `Explorer les ${LOADOUT_APPS_LABEL} prêtes à l’emploi`
@@ -17205,6 +17418,10 @@ var LOADOUT_ONBOARDING_GUIDE_MESSAGES = {
       completedTitle: "別のタスクを実行",
       description: "AIアプリを選び、タスクを入力します。",
       exploreDescription: `リサーチ、コンテンツ、動画などに${LOADOUT_APPS_LABEL}を活用できます。`,
+      hostedAction: "ホスト型エージェントを試す",
+      hostedDescription: "エージェントをインストールせずに、スマートフォンで実際のタスクを実行できます。",
+      hostedTitle: "スマートフォンでLoadoutを試す",
+      returnToHostedResult: "ホスト型エージェントの結果に戻る",
       placeholder: "タスクを入力...",
       title: "Loadoutでタスクを実行",
       tryTool: `すぐに使える${LOADOUT_APPS_LABEL}を探す`
@@ -17262,6 +17479,10 @@ var LOADOUT_ONBOARDING_GUIDE_MESSAGES = {
       completedTitle: "एक और टास्क चलाएं",
       description: "अपना AI ऐप चुनें, फिर एक टास्क दर्ज करें।",
       exploreDescription: `रिसर्च, कंटेंट, वीडियो और अन्य काम के लिए ${LOADOUT_APPS_LABEL} इस्तेमाल करें।`,
+      hostedAction: "होस्टेड एजेंट आज़माएं",
+      hostedDescription: "बिना एजेंट इंस्टॉल किए फ़ोन पर असली टास्क चलाएं।",
+      hostedTitle: "फ़ोन पर Loadout आज़माएं",
+      returnToHostedResult: "होस्टेड परिणाम पर वापस जाएं",
       placeholder: "टास्क दर्ज करें...",
       title: "Loadout से टास्क चलाएं",
       tryTool: `तैयार ${LOADOUT_APPS_LABEL} देखें`
@@ -18683,7 +18904,7 @@ async function stageOnboardingSkill(home, artifact) {
 
 // src/onboarding/transaction.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { cp, lstat as lstat11, mkdir as mkdir12, readdir as readdir6, readFile as readFile17, rename as rename8, rm as rm7, symlink as symlink5 } from "node:fs/promises";
+import { cp as cp2, lstat as lstat11, mkdir as mkdir12, readdir as readdir6, readFile as readFile17, rename as rename8, rm as rm7, symlink as symlink5 } from "node:fs/promises";
 import { dirname as dirname11, join as join16, relative as relative5 } from "node:path";
 async function applyOnboardingPlan(plan, options) {
   if (options.confirmationDigest !== plan.confirmationDigest)
@@ -18851,7 +19072,7 @@ async function applyChange(change, desiredContent, options) {
   if (change.action === "copy" /* Copy */) {
     const temporary = `${change.target}.${randomUUID8()}.tmp`;
     await mkdir12(dirname11(temporary), { recursive: true, mode: 448 });
-    await cp(options.skillSourceDirectory, temporary, { recursive: true, errorOnExist: true });
+    await cp2(options.skillSourceDirectory, temporary, { recursive: true, errorOnExist: true });
     await rename8(temporary, change.target);
     return;
   }
@@ -19002,7 +19223,7 @@ class OnboardingService {
   }
 }
 
-// ../web/shared/loadout/LoadoutOnboardingTelemetry.ts
+// ../web/shared/loadout/LoadoutOnboardingTelemetryContract.ts
 var LoadoutOnboardingPath;
 ((LoadoutOnboardingPath) => {
   LoadoutOnboardingPath["Unselected"] = "unselected";
@@ -19019,6 +19240,8 @@ var LoadoutOnboardingTelemetryStage;
   LoadoutOnboardingTelemetryStage["LoginCompleted"] = "login_completed";
   LoadoutOnboardingTelemetryStage["MethodSelected"] = "method_selected";
   LoadoutOnboardingTelemetryStage["NativeDownloadStarted"] = "native_download_started";
+  LoadoutOnboardingTelemetryStage["PackageInstallStarted"] = "package_install_started";
+  LoadoutOnboardingTelemetryStage["PackageInstallCompleted"] = "package_install_completed";
   LoadoutOnboardingTelemetryStage["DesktopStarted"] = "desktop_started";
   LoadoutOnboardingTelemetryStage["InstallationCompleted"] = "installation_completed";
   LoadoutOnboardingTelemetryStage["OnboardingStarted"] = "onboarding_started";
@@ -19055,6 +19278,8 @@ var LoadoutOnboardingLaunchSource;
   LoadoutOnboardingLaunchSource["Desktop"] = "desktop";
   LoadoutOnboardingLaunchSource["Web"] = "web";
 })(LoadoutOnboardingLaunchSource ||= {});
+
+// ../web/shared/loadout/LoadoutOnboardingTelemetry.ts
 var LoadoutOnboardingClientFamily;
 ((LoadoutOnboardingClientFamily) => {
   LoadoutOnboardingClientFamily["Aident"] = "aident";
@@ -19168,6 +19393,8 @@ function recordLoadoutOnboardingTelemetry(baseUrl, event, fetchImpl = fetch) {
   genRecordLoadoutOnboardingTelemetry(baseUrl, event, fetchImpl);
 }
 async function genRecordLoadoutOnboardingTelemetry(baseUrl, event, fetchImpl = fetch) {
+  if (process.env.AIDENT_DISABLE_ONBOARDING_TELEMETRY === "1")
+    return false;
   const endpoint = `${baseUrl.replace(/\/+$/, "")}/.well-known/aident-onboarding-event`;
   if (!isTrustedAidentMetadataUrl(endpoint))
     return false;
@@ -19204,11 +19431,22 @@ var UI_FILES = ["index.html", "app.js", "style.css"];
 var MAX_UI_BYTES = 5 * 1024 * 1024;
 async function resolveOnboardingUiAssets(baseUrl, cliVersion, home) {
   const cacheRoot = join17(home, ".aident", "ui");
-  return Promise.race([resolveOnlineOrCached(baseUrl, cliVersion, cacheRoot), resolveTimeout(2000)]);
+  const controller = new AbortController;
+  const fallback = new Promise((resolve) => {
+    controller.signal.addEventListener("abort", () => resolve(null), { once: true });
+  });
+  const timeout = setTimeout(() => controller.abort(), 2000);
+  timeout.unref();
+  try {
+    return await Promise.race([resolveOnlineOrCached(baseUrl, cliVersion, cacheRoot, controller.signal), fallback]);
+  } finally {
+    clearTimeout(timeout);
+    controller.abort();
+  }
 }
-async function resolveOnlineOrCached(baseUrl, cliVersion, cacheRoot) {
+async function resolveOnlineOrCached(baseUrl, cliVersion, cacheRoot, signal) {
   try {
-    const metadata = await fetchLoadoutSkillMetadata(baseUrl);
+    const metadata = await fetchLoadoutSkillMetadata(baseUrl, signal);
     const policy = metadata?.updatePolicy;
     const descriptor = policy?.schemaVersion === 2 ? policy.onboardingUi : undefined;
     if (!descriptor || !isCompatible(descriptor, cliVersion))
@@ -19216,7 +19454,7 @@ async function resolveOnlineOrCached(baseUrl, cliVersion, cacheRoot) {
     if (!isTrustedAidentMetadataUrl(descriptor.url) || new URL(descriptor.url).origin !== new URL(baseUrl).origin) {
       return loadCachedUi(cacheRoot, cliVersion);
     }
-    const response = await fetch(descriptor.url, { redirect: "error" });
+    const response = await fetch(descriptor.url, { redirect: "error", signal });
     if (!response.ok)
       return loadCachedUi(cacheRoot, cliVersion);
     const bytes = await readBoundedResponseBody(response, descriptor.byteLength, MAX_UI_BYTES, "onboarding-ui-response-too-large");
@@ -19229,12 +19467,6 @@ async function resolveOnlineOrCached(baseUrl, cliVersion, cacheRoot) {
     return loadCachedUi(cacheRoot, cliVersion);
   }
 }
-function resolveTimeout(milliseconds) {
-  return new Promise((resolve) => {
-    const timer = setTimeout(() => resolve(null), milliseconds);
-    timer.unref();
-  });
-}
 function verifyArtifact(bytes, descriptor) {
   return descriptor.byteLength <= MAX_UI_BYTES && bytes.byteLength === descriptor.byteLength && createHash11("sha256").update(bytes).digest("hex") === descriptor.sha256 && verifyMinisign(bytes, descriptor.signature, descriptor.signingKeyId);
 }