@aident-ai/cli 0.3.1 → 0.3.2-rc.ci.37567087135.1

package/dist/dsh.mjs

@@ -2542,552 +2542,6 @@ function readLine(prompt, options = {}) {
   });
 }
 
-// src/auth.ts
-var CLIENT_NAME = "aident-cli";
-var LOOPBACK_HOST = "127.0.0.1";
-var LOGIN_OPEN_TIMEOUT_MS = 90 * 1000;
-var LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS = 30 * 60 * 1000;
-var LOGIN_OPENED_MESSAGE = `User opened the Aident login window. They have ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 60000} minutes to finish; if it fails, run \`aident login --oob\`, share the URL, and ask for the verification code.`;
-async function login(options) {
-  const baseUrl = options.baseUrl.replace(/\/+$/, "");
-  const writeInfo = options.format === "json" ? logErr : logInfo;
-  if (options.oob)
-    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
-  try {
-    return await loginLoopback(baseUrl, writeInfo, options.ref);
-  } catch (err) {
-    logErr(`Loopback OAuth failed (${err instanceof Error ? err.message : String(err)}). Falling back to OOB flow.`);
-    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
-  }
-}
-async function refreshToken(creds) {
-  if (!creds.refresh_token || !creds.client_id)
-    return null;
-  const baseUrl = creds.base_url.replace(/\/+$/, "");
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: creds.client_id,
-    refresh_token: creds.refresh_token
-  });
-  const res = await fetch(`${baseUrl}/api/mcp/oauth/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  if (!res.ok)
-    return null;
-  const tok = await res.json();
-  return updateCredsFromToken(creds, tok);
-}
-async function logout(creds) {
-  const baseUrl = creds.base_url.replace(/\/+$/, "");
-  await fetch(`${baseUrl}/api/mcp/oauth/revoke`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Authorization: `Bearer ${creds.access_token}`
-    },
-    body: new URLSearchParams({ token: creds.access_token })
-  }).catch(() => {
-    return;
-  });
-}
-async function loginLoopback(baseUrl, writeInfo, ref) {
-  const verifier = base64UrlEncode(randomBytes(48));
-  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
-  const state = base64UrlEncode(randomBytes(16));
-  const { server, port, codePromise, setExpectedOpenRedirectUrl } = await startCallbackServer(state, writeInfo);
-  const redirectUri = `http://${LOOPBACK_HOST}:${port}/callback`;
-  const clientId = await registerClient(baseUrl, [redirectUri]);
-  const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
-  authorizeUrl.searchParams.set("response_type", "code");
-  authorizeUrl.searchParams.set("client_id", clientId);
-  authorizeUrl.searchParams.set("redirect_uri", redirectUri);
-  authorizeUrl.searchParams.set("redirect_uri_exact", base64UrlEncode(Buffer.from(redirectUri, "utf8")));
-  authorizeUrl.searchParams.set("code_challenge", challenge);
-  authorizeUrl.searchParams.set("code_challenge_method", "S256");
-  authorizeUrl.searchParams.set("state", state);
-  if (ref)
-    authorizeUrl.searchParams.set("via", ref);
-  const authorizeUrlString = authorizeUrl.toString();
-  setExpectedOpenRedirectUrl(authorizeUrlString);
-  const loginOpenUrl = buildLoginOpenUrl(port, state, authorizeUrlString);
-  writeInfo(`Opening browser for Aident login...`);
-  writeInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
-  openExternalUrl(shouldUseLoopbackBrowserHandoff() ? loginOpenUrl : authorizeUrlString);
-  let code;
-  try {
-    code = await codePromise;
-  } finally {
-    closeServer(server);
-  }
-  const tok = await exchangeCode(baseUrl, clientId, code, redirectUri, verifier);
-  return buildCreds(baseUrl, clientId, tok);
-}
-async function loginOob(baseUrl, writeInfo, promptOutput, ref) {
-  const redirectUri = `${baseUrl}/mcp/oob`;
-  const verifier = base64UrlEncode(randomBytes(48));
-  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
-  const state = base64UrlEncode(randomBytes(16));
-  let clientId = "";
-  let valueToExchange = "";
-  try {
-    clientId = await registerClient(baseUrl, [redirectUri]);
-    const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
-    authorizeUrl.searchParams.set("response_type", "code");
-    authorizeUrl.searchParams.set("client_id", clientId);
-    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
-    authorizeUrl.searchParams.set("code_challenge", challenge);
-    authorizeUrl.searchParams.set("code_challenge_method", "S256");
-    authorizeUrl.searchParams.set("state", state);
-    if (ref)
-      authorizeUrl.searchParams.set("via", ref);
-    const authorizeUrlString = authorizeUrl.toString();
-    writeInfo(`Opening browser for Aident login...`);
-    writeInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
-    openExternalUrl(authorizeUrlString);
-    writeInfo("After approving, paste the 8-digit verification code shown on the Aident page below.");
-    const pastedInput = await readLine("Paste 8-digit code here: ", {
-      output: promptOutput,
-      timeoutMs: LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS,
-      timeoutMessage: `Verification code not received within ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 1000}s; aborting.`
-    });
-    valueToExchange = normalizeOobLoginInput(pastedInput);
-    if (!valueToExchange)
-      throw new Error("No verification code provided");
-    if (!/^\d{8}$/.test(valueToExchange) && !looksLikeAccessToken(valueToExchange)) {
-      throw new Error("Pasted value is not a valid 8-digit verification code. Please retry the login.");
-    }
-    const tok = await exchangeCode(baseUrl, clientId, valueToExchange, redirectUri, verifier);
-    return buildCreds(baseUrl, clientId, tok);
-  } catch (err) {
-    if (err instanceof OAuthRejectedError) {
-      if (!looksLikeAccessToken(valueToExchange)) {
-        throw new Error("Pasted verification code was rejected by the server. Please retry the login.");
-      }
-      logErr(`Server rejected the pasted value as an authorization code. Treating it as a raw access token. Note: token refresh is unavailable in this mode — when the token expires you'll need to run \`aident login\` again.`);
-      return { base_url: baseUrl, client_id: clientId, access_token: valueToExchange };
-    }
-    throw err;
-  }
-}
-function normalizeVerificationCodeInput(value) {
-  return value.trim().replace(/[\s-]+/g, "");
-}
-function normalizeOobLoginInput(value) {
-  const verificationCode = normalizeVerificationCodeInput(value);
-  if (/^\d{8}$/.test(verificationCode))
-    return verificationCode;
-  return value.trim().replace(/\s+/g, "");
-}
-function looksLikeAccessToken(value) {
-  if (value.length < 20)
-    return false;
-  if (/\s/.test(value))
-    return false;
-  return /^[A-Za-z0-9._-]+$/.test(value);
-}
-async function registerClient(baseUrl, redirectUris) {
-  const res = await fetch(`${baseUrl}/api/mcp/oauth/register`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      client_name: CLIENT_NAME,
-      redirect_uris: redirectUris,
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none"
-    })
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Failed to register OAuth client (HTTP ${res.status}): ${text}`);
-  }
-  const json = await res.json();
-  if (!json.client_id)
-    throw new Error("OAuth registration response missing client_id");
-  return json.client_id;
-}
-
-class OAuthRejectedError extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "OAuthRejectedError";
-  }
-}
-async function exchangeCode(baseUrl, clientId, code, redirectUri, verifier) {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: clientId,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
-  });
-  const res = await fetch(`${baseUrl}/api/mcp/oauth/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    if (res.status >= 400 && res.status < 500) {
-      throw new OAuthRejectedError(`Token exchange rejected (HTTP ${res.status}): ${text}`, res.status);
-    }
-    throw new Error(`Token exchange failed (HTTP ${res.status}): ${text}`);
-  }
-  return await res.json();
-}
-function buildCreds(baseUrl, clientId, tok) {
-  const expiresAt = tok.expires_in ? new Date(Date.now() + tok.expires_in * 1000).toISOString() : undefined;
-  return {
-    base_url: baseUrl,
-    client_id: clientId,
-    access_token: tok.access_token,
-    refresh_token: tok.refresh_token,
-    expires_at: expiresAt
-  };
-}
-function updateCredsFromToken(creds, tok) {
-  const expiresAt = tok.expires_in ? new Date(Date.now() + tok.expires_in * 1000).toISOString() : creds.expires_at;
-  return {
-    ...creds,
-    access_token: tok.access_token,
-    refresh_token: tok.refresh_token ?? creds.refresh_token,
-    expires_at: expiresAt
-  };
-}
-function startCallbackServer(expectedState, writeInfo = logInfo) {
-  return new Promise((resolve, reject) => {
-    let codeResolver = () => {
-      return;
-    };
-    let codeRejecter = () => {
-      return;
-    };
-    let opened = false;
-    let expectedOpenRedirectUrl = "";
-    let completeTimeout;
-    const codePromise = new Promise((res, rej) => {
-      codeResolver = res;
-      codeRejecter = rej;
-    });
-    const scheduleCompleteTimeout = (timeoutMs, message) => {
-      if (completeTimeout)
-        clearTimeout(completeTimeout);
-      completeTimeout = setTimeout(() => codeRejecter(new Error(message)), timeoutMs);
-    };
-    const openTimeout = setTimeout(() => {
-      if (!opened) {
-        writeInfo(`Login window open signal not received within ${LOGIN_OPEN_TIMEOUT_MS / 1000}s; still waiting for login to finish.`);
-      }
-    }, LOGIN_OPEN_TIMEOUT_MS);
-    scheduleCompleteTimeout(LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS, `Authorization callback not received within ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 1000}s; aborting.`);
-    codePromise.then(() => {
-      clearTimeout(openTimeout);
-      if (completeTimeout)
-        clearTimeout(completeTimeout);
-    }, () => {
-      clearTimeout(openTimeout);
-      if (completeTimeout)
-        clearTimeout(completeTimeout);
-    });
-    const markOpened = () => {
-      if (opened)
-        return;
-      opened = true;
-      clearTimeout(openTimeout);
-      writeInfo(LOGIN_OPENED_MESSAGE);
-      const timeoutMs = LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS;
-      scheduleCompleteTimeout(timeoutMs, `Login page opened but did not complete within ${timeoutMs / 1000}s; aborting.`);
-    };
-    const server = createServer((req, res) => {
-      runLocalCallbackHandler(req, res, () => {
-        if (!req.url) {
-          res.writeHead(400);
-          res.end("Bad request");
-          return;
-        }
-        const url = new URL(req.url, `http://${LOOPBACK_HOST}`);
-        if (handleOpenRedirect(url, res, expectedState, expectedOpenRedirectUrl, markOpened))
-          return;
-        if (url.pathname !== "/callback") {
-          res.writeHead(404);
-          res.end("Not found");
-          return;
-        }
-        const code = url.searchParams.get("code");
-        const state = url.searchParams.get("state");
-        const error = url.searchParams.get("error");
-        if (error) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(`<html><body><h2>Authentication error</h2><p>${escapeHtml(error)}</p></body></html>`);
-          codeRejecter(new Error(`OAuth error: ${error}`));
-          return;
-        }
-        if (!code || state !== expectedState) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end("<html><body><h2>Invalid callback</h2></body></html>");
-          codeRejecter(new Error("Invalid callback (missing code or bad state)"));
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(`<html><body style="font-family:system-ui;padding:40px;text-align:center"><h2>You're signed in.</h2><p>You can close this window and return to the terminal.</p></body></html>`);
-        codeResolver(code);
-      }, codeRejecter);
-    });
-    server.once("error", reject);
-    server.listen(0, LOOPBACK_HOST, () => {
-      const addr = server.address();
-      resolve({
-        server,
-        port: addr.port,
-        codePromise,
-        setExpectedOpenRedirectUrl: (url) => {
-          expectedOpenRedirectUrl = url;
-        }
-      });
-    });
-  });
-}
-function handleOpenRedirect(url, res, expectedState, expectedOpenRedirectUrl, onOpened) {
-  if (url.pathname !== "/open")
-    return false;
-  if (url.searchParams.get("state") !== expectedState) {
-    res.writeHead(400);
-    res.end("Bad request");
-    return true;
-  }
-  const nextUrl = url.searchParams.get("next");
-  if (!expectedOpenRedirectUrl || !nextUrl || nextUrl !== expectedOpenRedirectUrl) {
-    res.writeHead(400);
-    res.end("Bad request");
-    return true;
-  }
-  try {
-    onOpened();
-  } catch {
-    res.writeHead(500);
-    res.end("Internal callback error");
-    return true;
-  }
-  res.writeHead(302, { Location: nextUrl });
-  res.end();
-  return true;
-}
-function runLocalCallbackHandler(req, res, handle, onAuthCallbackError) {
-  try {
-    handle();
-  } catch (err) {
-    if (!res.writableEnded) {
-      if (!res.headersSent)
-        res.writeHead(500);
-      res.end("Internal callback error");
-    }
-    if (isAuthCallbackRequest(req.url))
-      onAuthCallbackError?.(toError(err));
-  }
-}
-function isAuthCallbackRequest(url) {
-  if (!url)
-    return false;
-  try {
-    return new URL(url, `http://${LOOPBACK_HOST}`).pathname === "/callback";
-  } catch {
-    return false;
-  }
-}
-function toError(err) {
-  return err instanceof Error ? err : new Error(String(err));
-}
-function closeServer(server) {
-  server.close();
-  server.closeIdleConnections?.();
-  server.closeAllConnections?.();
-}
-function buildLoginOpenUrl(port, state, authorizeUrl) {
-  const url = new URL(`http://${LOOPBACK_HOST}:${port}/open`);
-  url.searchParams.set("state", state);
-  url.searchParams.set("next", authorizeUrl);
-  return url.toString();
-}
-function shouldUseLoopbackBrowserHandoff(env = process.env) {
-  return !isRemoteSessionEnvironment(env);
-}
-function isRemoteSessionEnvironment(env = process.env) {
-  return Boolean(env.SSH_CONNECTION || env.SSH_TTY || env.CODESPACES || env.REMOTE_CONTAINERS || env.DEVCONTAINER);
-}
-function base64UrlEncode(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-
-// src/catalogCache.ts
-import crypto from "node:crypto";
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-
-// src/config.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-
-// src/packages.ts
-var CLI_PACKAGES = ["loadout", "playbook", "intern"];
-var DEFAULT_CLI_PACKAGES = ["loadout"];
-function parseCliPackage(value) {
-  if (typeof value !== "string")
-    throw new Error(`Unsupported Aident package: ${String(value)}`);
-  const normalized = value.trim().toLowerCase();
-  if (!CLI_PACKAGES.includes(normalized))
-    throw new Error(`Unsupported Aident package: ${value}`);
-  return normalized;
-}
-function normalizeCliPackages(value) {
-  const rawPackages = value === undefined || value === null || value === "" ? [] : Array.isArray(value) ? value : String(value).split(/[,\s]+/);
-  const packages = ["loadout"];
-  for (const rawPackage of rawPackages) {
-    if (rawPackage === undefined || rawPackage === null || rawPackage === "")
-      continue;
-    const cliPackage = parseCliPackage(rawPackage);
-    if (!packages.includes(cliPackage))
-      packages.push(cliPackage);
-  }
-  return packages;
-}
-function formatCliPackages(packages) {
-  return packages.join(",");
-}
-
-// ../web/shared/env/loadoutHostPairs.json
-var loadoutHostPairs_default = [
-  {
-    appHost: "app.aident.ai",
-    loadoutHost: "loadout.aident.ai"
-  },
-  {
-    appHost: "staging.app.aident.ai",
-    loadoutHost: "staging.loadout.aident.ai"
-  },
-  {
-    appHost: "rc.app.aident.ai",
-    loadoutHost: "rc.loadout.aident.ai"
-  }
-];
-
-// ../web/shared/env/loadoutHosts.ts
-var LOADOUT_PRODUCTION_HOST = "loadout.aident.ai";
-var LOADOUT_STAGING_HOST = "staging.loadout.aident.ai";
-var LOADOUT_PREVIEW_HOST = "rc.loadout.aident.ai";
-var LOADOUT_CUSTOM_HOSTS = [LOADOUT_PRODUCTION_HOST, LOADOUT_STAGING_HOST, LOADOUT_PREVIEW_HOST];
-var LOADOUT_HOST_BY_AIDENT_APP_HOST = Object.fromEntries(loadoutHostPairs_default.map(({ appHost, loadoutHost }) => [appHost, loadoutHost]));
-var AIDENT_PUBLIC_HOSTS = new Set(["aident.ai", "www.aident.ai"]);
-function getLoadoutHostname(host) {
-  return (host ?? "").split(":")[0]?.toLowerCase() ?? "";
-}
-function isLoadoutCustomHost(host) {
-  const hostname = getLoadoutHostname(host);
-  return LOADOUT_CUSTOM_HOSTS.some((candidate) => candidate === hostname) || /^pr-\d+-loadout\.prebuilt\.aident\.ai$/.test(hostname);
-}
-function isTrustedAidentHttpsUrl(value) {
-  try {
-    const url = value instanceof URL ? value : new URL(value);
-    const hostname = url.hostname.toLowerCase();
-    return url.protocol === "https:" && url.port === "" && url.username === "" && url.password === "" && (hostname === "aident.ai" || hostname.endsWith(".aident.ai"));
-  } catch {
-    return false;
-  }
-}
-function getLoadoutHostForAidentAppHost(host) {
-  const hostname = getLoadoutHostname(host);
-  return LOADOUT_HOST_BY_AIDENT_APP_HOST[hostname] ?? null;
-}
-function getCanonicalLoadoutHost(host) {
-  const hostname = getLoadoutHostname(host);
-  return getLoadoutHostForAidentAppHost(hostname) ?? (isLoadoutCustomHost(hostname) ? hostname : null);
-}
-function getLoadoutHostForLegacyAidentHost(host) {
-  const hostname = getLoadoutHostname(host);
-  return AIDENT_PUBLIC_HOSTS.has(hostname) ? LOADOUT_PRODUCTION_HOST : getCanonicalLoadoutHost(hostname);
-}
-
-// src/config.ts
-function getAidentDir(home = process.env.HOME || process.env.USERPROFILE || homedir()) {
-  return join(home, ".aident");
-}
-function getConfigFile() {
-  return join(getAidentDir(), "config.json");
-}
-function getConfigFileForHome(home) {
-  return join(getAidentDir(home), "config.json");
-}
-var DEFAULT_BASE_URL = "https://loadout.aident.ai"?.trim() || "https://loadout.aident.ai";
-var CONFIG_KEYS = ["baseUrl", "packages"];
-async function readConfig(configFile = getConfigFile()) {
-  try {
-    const text = await readFile(configFile, "utf-8");
-    const parsed = JSON.parse(text);
-    if (!parsed || typeof parsed !== "object")
-      return {};
-    if (typeof parsed.baseUrl === "string")
-      parsed.baseUrl = normalizeBaseUrl(parsed.baseUrl);
-    return parsed;
-  } catch {
-    return {};
-  }
-}
-async function writeConfig(config, configFile = getConfigFile()) {
-  await mkdir(dirname(configFile), { recursive: true, mode: 448 });
-  await writeFile(configFile, JSON.stringify(config, null, 2) + `
-`, { mode: 420 });
-}
-async function setConfigValue(key, value, configFile = getConfigFile()) {
-  const config = await readConfig(configFile);
-  config[key] = value;
-  await writeConfig(config, configFile);
-}
-async function unsetConfigValue(key) {
-  const config = await readConfig();
-  delete config[key];
-  await writeConfig(config);
-}
-async function resolveDefaultBaseUrl() {
-  const env = process.env.AIDENT_BASE_URL?.trim();
-  if (env)
-    return normalizeBaseUrl(env);
-  const config = await readConfig();
-  if (typeof config.baseUrl === "string" && config.baseUrl.trim() !== "") {
-    return normalizeBaseUrl(config.baseUrl);
-  }
-  return DEFAULT_BASE_URL;
-}
-async function resolveDefaultPackages() {
-  const env = process.env.AIDENT_PACKAGES?.trim() || process.env.AIDENT_PACKAGE?.trim();
-  if (env)
-    return normalizeCliPackages(env);
-  const config = await readConfig();
-  return normalizeCliPackages(config.packages ?? DEFAULT_CLI_PACKAGES);
-}
-async function resolveOriginClientName() {
-  const config = await readConfig();
-  return typeof config.originClientName === "string" && config.originClientName.trim() ? config.originClientName.trim() : null;
-}
-function isKnownConfigKey(key) {
-  return CONFIG_KEYS.includes(key);
-}
-function normalizeBaseUrl(url) {
-  let trimmed = url.trim();
-  if (!/^https?:\/\//i.test(trimmed))
-    trimmed = `https://${trimmed}`;
-  const normalized = trimmed.replace(/\/+$/, "");
-  const officialOrigin = /^https:\/\/([^/?#:@]+)$/i.exec(normalized);
-  const loadoutHost = getLoadoutHostForLegacyAidentHost(officialOrigin?.[1]);
-  return loadoutHost ? `https://${loadoutHost}` : normalized;
-}
-
 // ../../node_modules/zod/v3/helpers/util.js
 var util;
 (function(util) {
@@ -6498,407 +5952,967 @@ class ZodEffects extends ZodType {
           path: ctx.path,
           parent: ctx
         });
-        if (result.status === "aborted")
+        if (result.status === "aborted")
+          return INVALID;
+        if (result.status === "dirty")
+          return DIRTY(result.value);
+        if (status.value === "dirty")
+          return DIRTY(result.value);
+        return result;
+      }
+    }
+    if (effect.type === "refinement") {
+      const executeRefinement = (acc) => {
+        const result = effect.refinement(acc, checkCtx);
+        if (ctx.common.async) {
+          return Promise.resolve(result);
+        }
+        if (result instanceof Promise) {
+          throw new Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");
+        }
+        return acc;
+      };
+      if (ctx.common.async === false) {
+        const inner = this._def.schema._parseSync({
+          data: ctx.data,
+          path: ctx.path,
+          parent: ctx
+        });
+        if (inner.status === "aborted")
+          return INVALID;
+        if (inner.status === "dirty")
+          status.dirty();
+        executeRefinement(inner.value);
+        return { status: status.value, value: inner.value };
+      } else {
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((inner) => {
+          if (inner.status === "aborted")
+            return INVALID;
+          if (inner.status === "dirty")
+            status.dirty();
+          return executeRefinement(inner.value).then(() => {
+            return { status: status.value, value: inner.value };
+          });
+        });
+      }
+    }
+    if (effect.type === "transform") {
+      if (ctx.common.async === false) {
+        const base = this._def.schema._parseSync({
+          data: ctx.data,
+          path: ctx.path,
+          parent: ctx
+        });
+        if (!isValid(base))
+          return INVALID;
+        const result = effect.transform(base.value, checkCtx);
+        if (result instanceof Promise) {
+          throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
+        }
+        return { status: status.value, value: result };
+      } else {
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
+          if (!isValid(base))
+            return INVALID;
+          return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
+            status: status.value,
+            value: result
+          }));
+        });
+      }
+    }
+    util.assertNever(effect);
+  }
+}
+ZodEffects.create = (schema, effect, params) => {
+  return new ZodEffects({
+    schema,
+    typeName: ZodFirstPartyTypeKind.ZodEffects,
+    effect,
+    ...processCreateParams(params)
+  });
+};
+ZodEffects.createWithPreprocess = (preprocess, schema, params) => {
+  return new ZodEffects({
+    schema,
+    effect: { type: "preprocess", transform: preprocess },
+    typeName: ZodFirstPartyTypeKind.ZodEffects,
+    ...processCreateParams(params)
+  });
+};
+class ZodOptional extends ZodType {
+  _parse(input) {
+    const parsedType = this._getType(input);
+    if (parsedType === ZodParsedType.undefined) {
+      return OK(undefined);
+    }
+    return this._def.innerType._parse(input);
+  }
+  unwrap() {
+    return this._def.innerType;
+  }
+}
+ZodOptional.create = (type, params) => {
+  return new ZodOptional({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodOptional,
+    ...processCreateParams(params)
+  });
+};
+
+class ZodNullable extends ZodType {
+  _parse(input) {
+    const parsedType = this._getType(input);
+    if (parsedType === ZodParsedType.null) {
+      return OK(null);
+    }
+    return this._def.innerType._parse(input);
+  }
+  unwrap() {
+    return this._def.innerType;
+  }
+}
+ZodNullable.create = (type, params) => {
+  return new ZodNullable({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodNullable,
+    ...processCreateParams(params)
+  });
+};
+
+class ZodDefault extends ZodType {
+  _parse(input) {
+    const { ctx } = this._processInputParams(input);
+    let data = ctx.data;
+    if (ctx.parsedType === ZodParsedType.undefined) {
+      data = this._def.defaultValue();
+    }
+    return this._def.innerType._parse({
+      data,
+      path: ctx.path,
+      parent: ctx
+    });
+  }
+  removeDefault() {
+    return this._def.innerType;
+  }
+}
+ZodDefault.create = (type, params) => {
+  return new ZodDefault({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodDefault,
+    defaultValue: typeof params.default === "function" ? params.default : () => params.default,
+    ...processCreateParams(params)
+  });
+};
+
+class ZodCatch extends ZodType {
+  _parse(input) {
+    const { ctx } = this._processInputParams(input);
+    const newCtx = {
+      ...ctx,
+      common: {
+        ...ctx.common,
+        issues: []
+      }
+    };
+    const result = this._def.innerType._parse({
+      data: newCtx.data,
+      path: newCtx.path,
+      parent: {
+        ...newCtx
+      }
+    });
+    if (isAsync(result)) {
+      return result.then((result) => {
+        return {
+          status: "valid",
+          value: result.status === "valid" ? result.value : this._def.catchValue({
+            get error() {
+              return new ZodError(newCtx.common.issues);
+            },
+            input: newCtx.data
+          })
+        };
+      });
+    } else {
+      return {
+        status: "valid",
+        value: result.status === "valid" ? result.value : this._def.catchValue({
+          get error() {
+            return new ZodError(newCtx.common.issues);
+          },
+          input: newCtx.data
+        })
+      };
+    }
+  }
+  removeCatch() {
+    return this._def.innerType;
+  }
+}
+ZodCatch.create = (type, params) => {
+  return new ZodCatch({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodCatch,
+    catchValue: typeof params.catch === "function" ? params.catch : () => params.catch,
+    ...processCreateParams(params)
+  });
+};
+
+class ZodNaN extends ZodType {
+  _parse(input) {
+    const parsedType = this._getType(input);
+    if (parsedType !== ZodParsedType.nan) {
+      const ctx = this._getOrReturnCtx(input);
+      addIssueToContext(ctx, {
+        code: ZodIssueCode.invalid_type,
+        expected: ZodParsedType.nan,
+        received: ctx.parsedType
+      });
+      return INVALID;
+    }
+    return { status: "valid", value: input.data };
+  }
+}
+ZodNaN.create = (params) => {
+  return new ZodNaN({
+    typeName: ZodFirstPartyTypeKind.ZodNaN,
+    ...processCreateParams(params)
+  });
+};
+var BRAND = Symbol("zod_brand");
+
+class ZodBranded extends ZodType {
+  _parse(input) {
+    const { ctx } = this._processInputParams(input);
+    const data = ctx.data;
+    return this._def.type._parse({
+      data,
+      path: ctx.path,
+      parent: ctx
+    });
+  }
+  unwrap() {
+    return this._def.type;
+  }
+}
+
+class ZodPipeline extends ZodType {
+  _parse(input) {
+    const { status, ctx } = this._processInputParams(input);
+    if (ctx.common.async) {
+      const handleAsync = async () => {
+        const inResult = await this._def.in._parseAsync({
+          data: ctx.data,
+          path: ctx.path,
+          parent: ctx
+        });
+        if (inResult.status === "aborted")
           return INVALID;
-        if (result.status === "dirty")
-          return DIRTY(result.value);
-        if (status.value === "dirty")
-          return DIRTY(result.value);
-        return result;
-      }
-    }
-    if (effect.type === "refinement") {
-      const executeRefinement = (acc) => {
-        const result = effect.refinement(acc, checkCtx);
-        if (ctx.common.async) {
-          return Promise.resolve(result);
-        }
-        if (result instanceof Promise) {
-          throw new Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");
+        if (inResult.status === "dirty") {
+          status.dirty();
+          return DIRTY(inResult.value);
+        } else {
+          return this._def.out._parseAsync({
+            data: inResult.value,
+            path: ctx.path,
+            parent: ctx
+          });
         }
-        return acc;
       };
-      if (ctx.common.async === false) {
-        const inner = this._def.schema._parseSync({
-          data: ctx.data,
+      return handleAsync();
+    } else {
+      const inResult = this._def.in._parseSync({
+        data: ctx.data,
+        path: ctx.path,
+        parent: ctx
+      });
+      if (inResult.status === "aborted")
+        return INVALID;
+      if (inResult.status === "dirty") {
+        status.dirty();
+        return {
+          status: "dirty",
+          value: inResult.value
+        };
+      } else {
+        return this._def.out._parseSync({
+          data: inResult.value,
           path: ctx.path,
           parent: ctx
         });
-        if (inner.status === "aborted")
-          return INVALID;
-        if (inner.status === "dirty")
-          status.dirty();
-        executeRefinement(inner.value);
-        return { status: status.value, value: inner.value };
-      } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((inner) => {
-          if (inner.status === "aborted")
-            return INVALID;
-          if (inner.status === "dirty")
-            status.dirty();
-          return executeRefinement(inner.value).then(() => {
-            return { status: status.value, value: inner.value };
-          });
-        });
       }
     }
-    if (effect.type === "transform") {
-      if (ctx.common.async === false) {
-        const base = this._def.schema._parseSync({
-          data: ctx.data,
-          path: ctx.path,
-          parent: ctx
-        });
-        if (!isValid(base))
-          return INVALID;
-        const result = effect.transform(base.value, checkCtx);
-        if (result instanceof Promise) {
-          throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
-        }
-        return { status: status.value, value: result };
-      } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
-          if (!isValid(base))
-            return INVALID;
-          return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
-            status: status.value,
-            value: result
-          }));
-        });
+  }
+  static create(a, b) {
+    return new ZodPipeline({
+      in: a,
+      out: b,
+      typeName: ZodFirstPartyTypeKind.ZodPipeline
+    });
+  }
+}
+
+class ZodReadonly extends ZodType {
+  _parse(input) {
+    const result = this._def.innerType._parse(input);
+    const freeze = (data) => {
+      if (isValid(data)) {
+        data.value = Object.freeze(data.value);
+      }
+      return data;
+    };
+    return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
+  }
+  unwrap() {
+    return this._def.innerType;
+  }
+}
+ZodReadonly.create = (type, params) => {
+  return new ZodReadonly({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodReadonly,
+    ...processCreateParams(params)
+  });
+};
+var late = {
+  object: ZodObject.lazycreate
+};
+var ZodFirstPartyTypeKind;
+(function(ZodFirstPartyTypeKind) {
+  ZodFirstPartyTypeKind["ZodString"] = "ZodString";
+  ZodFirstPartyTypeKind["ZodNumber"] = "ZodNumber";
+  ZodFirstPartyTypeKind["ZodNaN"] = "ZodNaN";
+  ZodFirstPartyTypeKind["ZodBigInt"] = "ZodBigInt";
+  ZodFirstPartyTypeKind["ZodBoolean"] = "ZodBoolean";
+  ZodFirstPartyTypeKind["ZodDate"] = "ZodDate";
+  ZodFirstPartyTypeKind["ZodSymbol"] = "ZodSymbol";
+  ZodFirstPartyTypeKind["ZodUndefined"] = "ZodUndefined";
+  ZodFirstPartyTypeKind["ZodNull"] = "ZodNull";
+  ZodFirstPartyTypeKind["ZodAny"] = "ZodAny";
+  ZodFirstPartyTypeKind["ZodUnknown"] = "ZodUnknown";
+  ZodFirstPartyTypeKind["ZodNever"] = "ZodNever";
+  ZodFirstPartyTypeKind["ZodVoid"] = "ZodVoid";
+  ZodFirstPartyTypeKind["ZodArray"] = "ZodArray";
+  ZodFirstPartyTypeKind["ZodObject"] = "ZodObject";
+  ZodFirstPartyTypeKind["ZodUnion"] = "ZodUnion";
+  ZodFirstPartyTypeKind["ZodDiscriminatedUnion"] = "ZodDiscriminatedUnion";
+  ZodFirstPartyTypeKind["ZodIntersection"] = "ZodIntersection";
+  ZodFirstPartyTypeKind["ZodTuple"] = "ZodTuple";
+  ZodFirstPartyTypeKind["ZodRecord"] = "ZodRecord";
+  ZodFirstPartyTypeKind["ZodMap"] = "ZodMap";
+  ZodFirstPartyTypeKind["ZodSet"] = "ZodSet";
+  ZodFirstPartyTypeKind["ZodFunction"] = "ZodFunction";
+  ZodFirstPartyTypeKind["ZodLazy"] = "ZodLazy";
+  ZodFirstPartyTypeKind["ZodLiteral"] = "ZodLiteral";
+  ZodFirstPartyTypeKind["ZodEnum"] = "ZodEnum";
+  ZodFirstPartyTypeKind["ZodEffects"] = "ZodEffects";
+  ZodFirstPartyTypeKind["ZodNativeEnum"] = "ZodNativeEnum";
+  ZodFirstPartyTypeKind["ZodOptional"] = "ZodOptional";
+  ZodFirstPartyTypeKind["ZodNullable"] = "ZodNullable";
+  ZodFirstPartyTypeKind["ZodDefault"] = "ZodDefault";
+  ZodFirstPartyTypeKind["ZodCatch"] = "ZodCatch";
+  ZodFirstPartyTypeKind["ZodPromise"] = "ZodPromise";
+  ZodFirstPartyTypeKind["ZodBranded"] = "ZodBranded";
+  ZodFirstPartyTypeKind["ZodPipeline"] = "ZodPipeline";
+  ZodFirstPartyTypeKind["ZodReadonly"] = "ZodReadonly";
+})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
+var stringType = ZodString.create;
+var numberType = ZodNumber.create;
+var nanType = ZodNaN.create;
+var bigIntType = ZodBigInt.create;
+var booleanType = ZodBoolean.create;
+var dateType = ZodDate.create;
+var symbolType = ZodSymbol.create;
+var undefinedType = ZodUndefined.create;
+var nullType = ZodNull.create;
+var anyType = ZodAny.create;
+var unknownType = ZodUnknown.create;
+var neverType = ZodNever.create;
+var voidType = ZodVoid.create;
+var arrayType = ZodArray.create;
+var objectType = ZodObject.create;
+var strictObjectType = ZodObject.strictCreate;
+var unionType = ZodUnion.create;
+var discriminatedUnionType = ZodDiscriminatedUnion.create;
+var intersectionType = ZodIntersection.create;
+var tupleType = ZodTuple.create;
+var recordType = ZodRecord.create;
+var mapType = ZodMap.create;
+var setType = ZodSet.create;
+var functionType = ZodFunction.create;
+var lazyType = ZodLazy.create;
+var literalType = ZodLiteral.create;
+var enumType = ZodEnum.create;
+var nativeEnumType = ZodNativeEnum.create;
+var promiseType = ZodPromise.create;
+var effectsType = ZodEffects.create;
+var optionalType = ZodOptional.create;
+var nullableType = ZodNullable.create;
+var preprocessType = ZodEffects.createWithPreprocess;
+var pipelineType = ZodPipeline.create;
+var NEVER = INVALID;
+// ../web/shared/loadout/LoadoutDesktopSession.ts
+var LOADOUT_DESKTOP_SESSION_PATH = "/api/loadout/desktop/session";
+var LOADOUT_DESKTOP_SESSION_SCOPE = "desktop:session";
+var LOADOUT_DESKTOP_CLIENT_ID = "aident_desktop_v1";
+var LoadoutDesktopSessionResponseSchema = objectType({
+  success: literalType(true),
+  userId: stringType().uuid(),
+  unchanged: literalType(true).optional()
+});
+
+// src/auth.ts
+var CLIENT_NAME = "aident-cli";
+var LOOPBACK_HOST = "127.0.0.1";
+var LOGIN_OPEN_TIMEOUT_MS = 90 * 1000;
+var LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS = 30 * 60 * 1000;
+var LOGIN_OPENED_MESSAGE = `User opened the Aident login window. They have ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 60000} minutes to finish; if it fails, run \`aident login --oob\`, share the URL, and ask for the verification code.`;
+async function login(options) {
+  const baseUrl = options.baseUrl.replace(/\/+$/, "");
+  const writeInfo = options.format === "json" ? logErr : logInfo;
+  if (options.oob)
+    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
+  try {
+    return await loginLoopback(baseUrl, writeInfo, options.ref);
+  } catch (err) {
+    logErr(`Loopback OAuth failed (${err instanceof Error ? err.message : String(err)}). Falling back to OOB flow.`);
+    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
+  }
+}
+async function refreshToken(creds) {
+  if (!creds.refresh_token || !creds.client_id)
+    return null;
+  const baseUrl = creds.base_url.replace(/\/+$/, "");
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: creds.client_id,
+    refresh_token: creds.refresh_token
+  });
+  const res = await fetch(`${baseUrl}/api/mcp/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!res.ok)
+    return null;
+  const tok = await res.json();
+  return updateCredsFromToken(creds, tok);
+}
+async function logout(creds) {
+  const baseUrl = creds.base_url.replace(/\/+$/, "");
+  await fetch(`${baseUrl}/api/mcp/oauth/revoke`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Authorization: `Bearer ${creds.access_token}`
+    },
+    body: new URLSearchParams({ token: creds.access_token })
+  }).catch(() => {
+    return;
+  });
+}
+async function loginLoopback(baseUrl, writeInfo, ref) {
+  const verifier = base64UrlEncode(randomBytes(48));
+  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
+  const state = base64UrlEncode(randomBytes(16));
+  const { server, port, codePromise, setExpectedOpenRedirectUrl } = await startCallbackServer(state, writeInfo);
+  const redirectUri = `http://${LOOPBACK_HOST}:${port}/callback`;
+  const { clientId, scope } = await genRegisterLoginClient(baseUrl, [redirectUri], true);
+  const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
+  authorizeUrl.searchParams.set("response_type", "code");
+  authorizeUrl.searchParams.set("client_id", clientId);
+  authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+  authorizeUrl.searchParams.set("redirect_uri_exact", base64UrlEncode(Buffer.from(redirectUri, "utf8")));
+  authorizeUrl.searchParams.set("code_challenge", challenge);
+  authorizeUrl.searchParams.set("code_challenge_method", "S256");
+  authorizeUrl.searchParams.set("state", state);
+  if (scope)
+    authorizeUrl.searchParams.set("scope", scope);
+  if (ref)
+    authorizeUrl.searchParams.set("via", ref);
+  const authorizeUrlString = authorizeUrl.toString();
+  setExpectedOpenRedirectUrl(authorizeUrlString);
+  const loginOpenUrl = buildLoginOpenUrl(port, state, authorizeUrlString);
+  writeInfo(`Opening browser for Aident login...`);
+  writeInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
+  openExternalUrl(shouldUseLoopbackBrowserHandoff() ? loginOpenUrl : authorizeUrlString);
+  let code;
+  try {
+    code = await codePromise;
+  } finally {
+    closeServer(server);
+  }
+  const tok = await exchangeCode(baseUrl, clientId, code, redirectUri, verifier);
+  return buildCreds(baseUrl, clientId, tok);
+}
+async function loginOob(baseUrl, writeInfo, promptOutput, ref) {
+  const redirectUri = `${baseUrl}/mcp/oob`;
+  const verifier = base64UrlEncode(randomBytes(48));
+  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
+  const state = base64UrlEncode(randomBytes(16));
+  let clientId = "";
+  let valueToExchange = "";
+  try {
+    ({ clientId } = await genRegisterLoginClient(baseUrl, [redirectUri]));
+    const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", clientId);
+    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("state", state);
+    if (ref)
+      authorizeUrl.searchParams.set("via", ref);
+    const authorizeUrlString = authorizeUrl.toString();
+    writeInfo(`Opening browser for Aident login...`);
+    writeInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
+    openExternalUrl(authorizeUrlString);
+    writeInfo("After approving, paste the 8-digit verification code shown on the Aident page below.");
+    const pastedInput = await readLine("Paste 8-digit code here: ", {
+      output: promptOutput,
+      timeoutMs: LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS,
+      timeoutMessage: `Verification code not received within ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 1000}s; aborting.`
+    });
+    valueToExchange = normalizeOobLoginInput(pastedInput);
+    if (!valueToExchange)
+      throw new Error("No verification code provided");
+    if (!/^\d{8}$/.test(valueToExchange) && !looksLikeAccessToken(valueToExchange)) {
+      throw new Error("Pasted value is not a valid 8-digit verification code. Please retry the login.");
+    }
+    const tok = await exchangeCode(baseUrl, clientId, valueToExchange, redirectUri, verifier);
+    return buildCreds(baseUrl, clientId, tok);
+  } catch (err) {
+    if (err instanceof OAuthRejectedError) {
+      if (!looksLikeAccessToken(valueToExchange)) {
+        throw new Error("Pasted verification code was rejected by the server. Please retry the login.");
       }
+      logErr(`Server rejected the pasted value as an authorization code. Treating it as a raw access token. Note: token refresh is unavailable in this mode — when the token expires you'll need to run \`aident login\` again.`);
+      return { base_url: baseUrl, client_id: clientId, access_token: valueToExchange };
     }
-    util.assertNever(effect);
+    throw err;
   }
 }
-ZodEffects.create = (schema, effect, params) => {
-  return new ZodEffects({
-    schema,
-    typeName: ZodFirstPartyTypeKind.ZodEffects,
-    effect,
-    ...processCreateParams(params)
-  });
-};
-ZodEffects.createWithPreprocess = (preprocess, schema, params) => {
-  return new ZodEffects({
-    schema,
-    effect: { type: "preprocess", transform: preprocess },
-    typeName: ZodFirstPartyTypeKind.ZodEffects,
-    ...processCreateParams(params)
+function normalizeVerificationCodeInput(value) {
+  return value.trim().replace(/[\s-]+/g, "");
+}
+function normalizeOobLoginInput(value) {
+  const verificationCode = normalizeVerificationCodeInput(value);
+  if (/^\d{8}$/.test(verificationCode))
+    return verificationCode;
+  return value.trim().replace(/\s+/g, "");
+}
+function looksLikeAccessToken(value) {
+  if (value.length < 20)
+    return false;
+  if (/\s/.test(value))
+    return false;
+  return /^[A-Za-z0-9._-]+$/.test(value);
+}
+async function genRegisterLoginClient(baseUrl, redirectUris, desktop = false) {
+  const res = await fetch(`${baseUrl}/api/mcp/oauth/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: CLIENT_NAME,
+      redirect_uris: redirectUris,
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
   });
-};
-class ZodOptional extends ZodType {
-  _parse(input) {
-    const parsedType = this._getType(input);
-    if (parsedType === ZodParsedType.undefined) {
-      return OK(undefined);
-    }
-    return this._def.innerType._parse(input);
-  }
-  unwrap() {
-    return this._def.innerType;
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Failed to register OAuth client (HTTP ${res.status}): ${text}`);
   }
+  const json = await res.json();
+  if (!json.client_id)
+    throw new Error("OAuth registration response missing client_id");
+  if (desktop && json.desktop_client_id === LOADOUT_DESKTOP_CLIENT_ID)
+    return { clientId: LOADOUT_DESKTOP_CLIENT_ID, scope: LOADOUT_DESKTOP_SESSION_SCOPE };
+  return { clientId: json.client_id };
 }
-ZodOptional.create = (type, params) => {
-  return new ZodOptional({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodOptional,
-    ...processCreateParams(params)
-  });
-};
 
-class ZodNullable extends ZodType {
-  _parse(input) {
-    const parsedType = this._getType(input);
-    if (parsedType === ZodParsedType.null) {
-      return OK(null);
-    }
-    return this._def.innerType._parse(input);
-  }
-  unwrap() {
-    return this._def.innerType;
+class OAuthRejectedError extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "OAuthRejectedError";
   }
 }
-ZodNullable.create = (type, params) => {
-  return new ZodNullable({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodNullable,
-    ...processCreateParams(params)
+async function exchangeCode(baseUrl, clientId, code, redirectUri, verifier) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: clientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: verifier
   });
-};
-
-class ZodDefault extends ZodType {
-  _parse(input) {
-    const { ctx } = this._processInputParams(input);
-    let data = ctx.data;
-    if (ctx.parsedType === ZodParsedType.undefined) {
-      data = this._def.defaultValue();
+  const res = await fetch(`${baseUrl}/api/mcp/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    if (res.status >= 400 && res.status < 500) {
+      throw new OAuthRejectedError(`Token exchange rejected (HTTP ${res.status}): ${text}`, res.status);
     }
-    return this._def.innerType._parse({
-      data,
-      path: ctx.path,
-      parent: ctx
-    });
-  }
-  removeDefault() {
-    return this._def.innerType;
+    throw new Error(`Token exchange failed (HTTP ${res.status}): ${text}`);
   }
+  return await res.json();
 }
-ZodDefault.create = (type, params) => {
-  return new ZodDefault({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodDefault,
-    defaultValue: typeof params.default === "function" ? params.default : () => params.default,
-    ...processCreateParams(params)
-  });
-};
-
-class ZodCatch extends ZodType {
-  _parse(input) {
-    const { ctx } = this._processInputParams(input);
-    const newCtx = {
-      ...ctx,
-      common: {
-        ...ctx.common,
-        issues: []
-      }
+function buildCreds(baseUrl, clientId, tok) {
+  const expiresAt = tok.expires_in ? new Date(Date.now() + tok.expires_in * 1000).toISOString() : undefined;
+  return {
+    base_url: baseUrl,
+    client_id: clientId,
+    access_token: tok.access_token,
+    refresh_token: tok.refresh_token,
+    expires_at: expiresAt
+  };
+}
+function updateCredsFromToken(creds, tok) {
+  const expiresAt = tok.expires_in ? new Date(Date.now() + tok.expires_in * 1000).toISOString() : creds.expires_at;
+  return {
+    ...creds,
+    access_token: tok.access_token,
+    refresh_token: tok.refresh_token ?? creds.refresh_token,
+    expires_at: expiresAt
+  };
+}
+function startCallbackServer(expectedState, writeInfo = logInfo) {
+  return new Promise((resolve, reject) => {
+    let codeResolver = () => {
+      return;
     };
-    const result = this._def.innerType._parse({
-      data: newCtx.data,
-      path: newCtx.path,
-      parent: {
-        ...newCtx
+    let codeRejecter = () => {
+      return;
+    };
+    let opened = false;
+    let expectedOpenRedirectUrl = "";
+    let completeTimeout;
+    const codePromise = new Promise((res, rej) => {
+      codeResolver = res;
+      codeRejecter = rej;
+    });
+    const scheduleCompleteTimeout = (timeoutMs, message) => {
+      if (completeTimeout)
+        clearTimeout(completeTimeout);
+      completeTimeout = setTimeout(() => codeRejecter(new Error(message)), timeoutMs);
+    };
+    const openTimeout = setTimeout(() => {
+      if (!opened) {
+        writeInfo(`Login window open signal not received within ${LOGIN_OPEN_TIMEOUT_MS / 1000}s; still waiting for login to finish.`);
       }
+    }, LOGIN_OPEN_TIMEOUT_MS);
+    scheduleCompleteTimeout(LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS, `Authorization callback not received within ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 1000}s; aborting.`);
+    codePromise.then(() => {
+      clearTimeout(openTimeout);
+      if (completeTimeout)
+        clearTimeout(completeTimeout);
+    }, () => {
+      clearTimeout(openTimeout);
+      if (completeTimeout)
+        clearTimeout(completeTimeout);
     });
-    if (isAsync(result)) {
-      return result.then((result) => {
-        return {
-          status: "valid",
-          value: result.status === "valid" ? result.value : this._def.catchValue({
-            get error() {
-              return new ZodError(newCtx.common.issues);
-            },
-            input: newCtx.data
-          })
-        };
+    const markOpened = () => {
+      if (opened)
+        return;
+      opened = true;
+      clearTimeout(openTimeout);
+      writeInfo(LOGIN_OPENED_MESSAGE);
+      const timeoutMs = LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS;
+      scheduleCompleteTimeout(timeoutMs, `Login page opened but did not complete within ${timeoutMs / 1000}s; aborting.`);
+    };
+    const server = createServer((req, res) => {
+      runLocalCallbackHandler(req, res, () => {
+        if (!req.url) {
+          res.writeHead(400);
+          res.end("Bad request");
+          return;
+        }
+        const url = new URL(req.url, `http://${LOOPBACK_HOST}`);
+        if (handleOpenRedirect(url, res, expectedState, expectedOpenRedirectUrl, markOpened))
+          return;
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not found");
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+        const error = url.searchParams.get("error");
+        if (error) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(`<html><body><h2>Authentication error</h2><p>${escapeHtml(error)}</p></body></html>`);
+          codeRejecter(new Error(`OAuth error: ${error}`));
+          return;
+        }
+        if (!code || state !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<html><body><h2>Invalid callback</h2></body></html>");
+          codeRejecter(new Error("Invalid callback (missing code or bad state)"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`<html><body style="font-family:system-ui;padding:40px;text-align:center"><h2>You're signed in.</h2><p>You can close this window and return to the terminal.</p></body></html>`);
+        codeResolver(code);
+      }, codeRejecter);
+    });
+    server.once("error", reject);
+    server.listen(0, LOOPBACK_HOST, () => {
+      const addr = server.address();
+      resolve({
+        server,
+        port: addr.port,
+        codePromise,
+        setExpectedOpenRedirectUrl: (url) => {
+          expectedOpenRedirectUrl = url;
+        }
       });
-    } else {
-      return {
-        status: "valid",
-        value: result.status === "valid" ? result.value : this._def.catchValue({
-          get error() {
-            return new ZodError(newCtx.common.issues);
-          },
-          input: newCtx.data
-        })
-      };
-    }
+    });
+  });
+}
+function handleOpenRedirect(url, res, expectedState, expectedOpenRedirectUrl, onOpened) {
+  if (url.pathname !== "/open")
+    return false;
+  if (url.searchParams.get("state") !== expectedState) {
+    res.writeHead(400);
+    res.end("Bad request");
+    return true;
   }
-  removeCatch() {
-    return this._def.innerType;
+  const nextUrl = url.searchParams.get("next");
+  if (!expectedOpenRedirectUrl || !nextUrl || nextUrl !== expectedOpenRedirectUrl) {
+    res.writeHead(400);
+    res.end("Bad request");
+    return true;
+  }
+  try {
+    onOpened();
+  } catch {
+    res.writeHead(500);
+    res.end("Internal callback error");
+    return true;
   }
+  res.writeHead(302, { Location: nextUrl });
+  res.end();
+  return true;
 }
-ZodCatch.create = (type, params) => {
-  return new ZodCatch({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodCatch,
-    catchValue: typeof params.catch === "function" ? params.catch : () => params.catch,
-    ...processCreateParams(params)
-  });
-};
-
-class ZodNaN extends ZodType {
-  _parse(input) {
-    const parsedType = this._getType(input);
-    if (parsedType !== ZodParsedType.nan) {
-      const ctx = this._getOrReturnCtx(input);
-      addIssueToContext(ctx, {
-        code: ZodIssueCode.invalid_type,
-        expected: ZodParsedType.nan,
-        received: ctx.parsedType
-      });
-      return INVALID;
+function runLocalCallbackHandler(req, res, handle, onAuthCallbackError) {
+  try {
+    handle();
+  } catch (err) {
+    if (!res.writableEnded) {
+      if (!res.headersSent)
+        res.writeHead(500);
+      res.end("Internal callback error");
     }
-    return { status: "valid", value: input.data };
+    if (isAuthCallbackRequest(req.url))
+      onAuthCallbackError?.(toError(err));
   }
 }
-ZodNaN.create = (params) => {
-  return new ZodNaN({
-    typeName: ZodFirstPartyTypeKind.ZodNaN,
-    ...processCreateParams(params)
-  });
-};
-var BRAND = Symbol("zod_brand");
-
-class ZodBranded extends ZodType {
-  _parse(input) {
-    const { ctx } = this._processInputParams(input);
-    const data = ctx.data;
-    return this._def.type._parse({
-      data,
-      path: ctx.path,
-      parent: ctx
-    });
-  }
-  unwrap() {
-    return this._def.type;
+function isAuthCallbackRequest(url) {
+  if (!url)
+    return false;
+  try {
+    return new URL(url, `http://${LOOPBACK_HOST}`).pathname === "/callback";
+  } catch {
+    return false;
   }
 }
+function toError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
+function closeServer(server) {
+  server.close();
+  server.closeIdleConnections?.();
+  server.closeAllConnections?.();
+}
+function buildLoginOpenUrl(port, state, authorizeUrl) {
+  const url = new URL(`http://${LOOPBACK_HOST}:${port}/open`);
+  url.searchParams.set("state", state);
+  url.searchParams.set("next", authorizeUrl);
+  return url.toString();
+}
+function shouldUseLoopbackBrowserHandoff(env = process.env) {
+  return !isRemoteSessionEnvironment(env);
+}
+function isRemoteSessionEnvironment(env = process.env) {
+  return Boolean(env.SSH_CONNECTION || env.SSH_TTY || env.CODESPACES || env.REMOTE_CONTAINERS || env.DEVCONTAINER);
+}
+function base64UrlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
 
-class ZodPipeline extends ZodType {
-  _parse(input) {
-    const { status, ctx } = this._processInputParams(input);
-    if (ctx.common.async) {
-      const handleAsync = async () => {
-        const inResult = await this._def.in._parseAsync({
-          data: ctx.data,
-          path: ctx.path,
-          parent: ctx
-        });
-        if (inResult.status === "aborted")
-          return INVALID;
-        if (inResult.status === "dirty") {
-          status.dirty();
-          return DIRTY(inResult.value);
-        } else {
-          return this._def.out._parseAsync({
-            data: inResult.value,
-            path: ctx.path,
-            parent: ctx
-          });
-        }
-      };
-      return handleAsync();
-    } else {
-      const inResult = this._def.in._parseSync({
-        data: ctx.data,
-        path: ctx.path,
-        parent: ctx
-      });
-      if (inResult.status === "aborted")
-        return INVALID;
-      if (inResult.status === "dirty") {
-        status.dirty();
-        return {
-          status: "dirty",
-          value: inResult.value
-        };
-      } else {
-        return this._def.out._parseSync({
-          data: inResult.value,
-          path: ctx.path,
-          parent: ctx
-        });
-      }
-    }
+// src/catalogCache.ts
+import crypto from "node:crypto";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+
+// src/config.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+// src/packages.ts
+var CLI_PACKAGES = ["loadout", "playbook", "intern"];
+var DEFAULT_CLI_PACKAGES = ["loadout"];
+function parseCliPackage(value) {
+  if (typeof value !== "string")
+    throw new Error(`Unsupported Aident package: ${String(value)}`);
+  const normalized = value.trim().toLowerCase();
+  if (!CLI_PACKAGES.includes(normalized))
+    throw new Error(`Unsupported Aident package: ${value}`);
+  return normalized;
+}
+function normalizeCliPackages(value) {
+  const rawPackages = value === undefined || value === null || value === "" ? [] : Array.isArray(value) ? value : String(value).split(/[,\s]+/);
+  const packages = ["loadout"];
+  for (const rawPackage of rawPackages) {
+    if (rawPackage === undefined || rawPackage === null || rawPackage === "")
+      continue;
+    const cliPackage = parseCliPackage(rawPackage);
+    if (!packages.includes(cliPackage))
+      packages.push(cliPackage);
   }
-  static create(a, b) {
-    return new ZodPipeline({
-      in: a,
-      out: b,
-      typeName: ZodFirstPartyTypeKind.ZodPipeline
-    });
+  return packages;
+}
+function formatCliPackages(packages) {
+  return packages.join(",");
+}
+
+// ../web/shared/env/loadoutHostPairs.json
+var loadoutHostPairs_default = [
+  {
+    appHost: "app.aident.ai",
+    loadoutHost: "loadout.aident.ai"
+  },
+  {
+    appHost: "staging.app.aident.ai",
+    loadoutHost: "staging.loadout.aident.ai"
+  },
+  {
+    appHost: "rc.app.aident.ai",
+    loadoutHost: "rc.loadout.aident.ai"
+  }
+];
+
+// ../web/shared/env/loadoutHosts.ts
+var LOADOUT_PRODUCTION_HOST = "loadout.aident.ai";
+var LOADOUT_STAGING_HOST = "staging.loadout.aident.ai";
+var LOADOUT_PREVIEW_HOST = "rc.loadout.aident.ai";
+var LOADOUT_CUSTOM_HOSTS = [LOADOUT_PRODUCTION_HOST, LOADOUT_STAGING_HOST, LOADOUT_PREVIEW_HOST];
+var LOADOUT_HOST_BY_AIDENT_APP_HOST = Object.fromEntries(loadoutHostPairs_default.map(({ appHost, loadoutHost }) => [appHost, loadoutHost]));
+var AIDENT_PUBLIC_HOSTS = new Set(["aident.ai", "www.aident.ai"]);
+function getLoadoutHostname(host) {
+  return (host ?? "").split(":")[0]?.toLowerCase() ?? "";
+}
+function isLoadoutCustomHost(host) {
+  const hostname = getLoadoutHostname(host);
+  return LOADOUT_CUSTOM_HOSTS.some((candidate) => candidate === hostname) || /^pr-\d+-loadout\.prebuilt\.aident\.ai$/.test(hostname);
+}
+function isTrustedAidentHttpsUrl(value) {
+  try {
+    const url = value instanceof URL ? value : new URL(value);
+    const hostname = url.hostname.toLowerCase();
+    return url.protocol === "https:" && url.port === "" && url.username === "" && url.password === "" && (hostname === "aident.ai" || hostname.endsWith(".aident.ai"));
+  } catch {
+    return false;
   }
 }
+function getLoadoutHostForAidentAppHost(host) {
+  const hostname = getLoadoutHostname(host);
+  return LOADOUT_HOST_BY_AIDENT_APP_HOST[hostname] ?? null;
+}
+function getCanonicalLoadoutHost(host) {
+  const hostname = getLoadoutHostname(host);
+  return getLoadoutHostForAidentAppHost(hostname) ?? (isLoadoutCustomHost(hostname) ? hostname : null);
+}
+function getLoadoutHostForLegacyAidentHost(host) {
+  const hostname = getLoadoutHostname(host);
+  return AIDENT_PUBLIC_HOSTS.has(hostname) ? LOADOUT_PRODUCTION_HOST : getCanonicalLoadoutHost(hostname);
+}
 
-class ZodReadonly extends ZodType {
-  _parse(input) {
-    const result = this._def.innerType._parse(input);
-    const freeze = (data) => {
-      if (isValid(data)) {
-        data.value = Object.freeze(data.value);
-      }
-      return data;
-    };
-    return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
+// src/config.ts
+function getAidentDir(home = process.env.HOME || process.env.USERPROFILE || homedir()) {
+  return join(home, ".aident");
+}
+function getConfigFile() {
+  return join(getAidentDir(), "config.json");
+}
+function getConfigFileForHome(home) {
+  return join(getAidentDir(home), "config.json");
+}
+var DEFAULT_BASE_URL = "https://rc.loadout.aident.ai"?.trim() || "https://loadout.aident.ai";
+var CONFIG_KEYS = ["baseUrl", "packages"];
+async function readConfig(configFile = getConfigFile()) {
+  try {
+    const text = await readFile(configFile, "utf-8");
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object")
+      return {};
+    if (typeof parsed.baseUrl === "string")
+      parsed.baseUrl = normalizeBaseUrl(parsed.baseUrl);
+    return parsed;
+  } catch {
+    return {};
   }
-  unwrap() {
-    return this._def.innerType;
+}
+async function writeConfig(config, configFile = getConfigFile()) {
+  await mkdir(dirname(configFile), { recursive: true, mode: 448 });
+  await writeFile(configFile, JSON.stringify(config, null, 2) + `
+`, { mode: 420 });
+}
+async function setConfigValue(key, value, configFile = getConfigFile()) {
+  const config = await readConfig(configFile);
+  config[key] = value;
+  await writeConfig(config, configFile);
+}
+async function unsetConfigValue(key) {
+  const config = await readConfig();
+  delete config[key];
+  await writeConfig(config);
+}
+async function resolveDefaultBaseUrl() {
+  const env = process.env.AIDENT_BASE_URL?.trim();
+  if (env)
+    return normalizeBaseUrl(env);
+  const config = await readConfig();
+  if (typeof config.baseUrl === "string" && config.baseUrl.trim() !== "") {
+    return normalizeBaseUrl(config.baseUrl);
   }
+  return DEFAULT_BASE_URL;
 }
-ZodReadonly.create = (type, params) => {
-  return new ZodReadonly({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodReadonly,
-    ...processCreateParams(params)
-  });
-};
-var late = {
-  object: ZodObject.lazycreate
-};
-var ZodFirstPartyTypeKind;
-(function(ZodFirstPartyTypeKind) {
-  ZodFirstPartyTypeKind["ZodString"] = "ZodString";
-  ZodFirstPartyTypeKind["ZodNumber"] = "ZodNumber";
-  ZodFirstPartyTypeKind["ZodNaN"] = "ZodNaN";
-  ZodFirstPartyTypeKind["ZodBigInt"] = "ZodBigInt";
-  ZodFirstPartyTypeKind["ZodBoolean"] = "ZodBoolean";
-  ZodFirstPartyTypeKind["ZodDate"] = "ZodDate";
-  ZodFirstPartyTypeKind["ZodSymbol"] = "ZodSymbol";
-  ZodFirstPartyTypeKind["ZodUndefined"] = "ZodUndefined";
-  ZodFirstPartyTypeKind["ZodNull"] = "ZodNull";
-  ZodFirstPartyTypeKind["ZodAny"] = "ZodAny";
-  ZodFirstPartyTypeKind["ZodUnknown"] = "ZodUnknown";
-  ZodFirstPartyTypeKind["ZodNever"] = "ZodNever";
-  ZodFirstPartyTypeKind["ZodVoid"] = "ZodVoid";
-  ZodFirstPartyTypeKind["ZodArray"] = "ZodArray";
-  ZodFirstPartyTypeKind["ZodObject"] = "ZodObject";
-  ZodFirstPartyTypeKind["ZodUnion"] = "ZodUnion";
-  ZodFirstPartyTypeKind["ZodDiscriminatedUnion"] = "ZodDiscriminatedUnion";
-  ZodFirstPartyTypeKind["ZodIntersection"] = "ZodIntersection";
-  ZodFirstPartyTypeKind["ZodTuple"] = "ZodTuple";
-  ZodFirstPartyTypeKind["ZodRecord"] = "ZodRecord";
-  ZodFirstPartyTypeKind["ZodMap"] = "ZodMap";
-  ZodFirstPartyTypeKind["ZodSet"] = "ZodSet";
-  ZodFirstPartyTypeKind["ZodFunction"] = "ZodFunction";
-  ZodFirstPartyTypeKind["ZodLazy"] = "ZodLazy";
-  ZodFirstPartyTypeKind["ZodLiteral"] = "ZodLiteral";
-  ZodFirstPartyTypeKind["ZodEnum"] = "ZodEnum";
-  ZodFirstPartyTypeKind["ZodEffects"] = "ZodEffects";
-  ZodFirstPartyTypeKind["ZodNativeEnum"] = "ZodNativeEnum";
-  ZodFirstPartyTypeKind["ZodOptional"] = "ZodOptional";
-  ZodFirstPartyTypeKind["ZodNullable"] = "ZodNullable";
-  ZodFirstPartyTypeKind["ZodDefault"] = "ZodDefault";
-  ZodFirstPartyTypeKind["ZodCatch"] = "ZodCatch";
-  ZodFirstPartyTypeKind["ZodPromise"] = "ZodPromise";
-  ZodFirstPartyTypeKind["ZodBranded"] = "ZodBranded";
-  ZodFirstPartyTypeKind["ZodPipeline"] = "ZodPipeline";
-  ZodFirstPartyTypeKind["ZodReadonly"] = "ZodReadonly";
-})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
-var stringType = ZodString.create;
-var numberType = ZodNumber.create;
-var nanType = ZodNaN.create;
-var bigIntType = ZodBigInt.create;
-var booleanType = ZodBoolean.create;
-var dateType = ZodDate.create;
-var symbolType = ZodSymbol.create;
-var undefinedType = ZodUndefined.create;
-var nullType = ZodNull.create;
-var anyType = ZodAny.create;
-var unknownType = ZodUnknown.create;
-var neverType = ZodNever.create;
-var voidType = ZodVoid.create;
-var arrayType = ZodArray.create;
-var objectType = ZodObject.create;
-var strictObjectType = ZodObject.strictCreate;
-var unionType = ZodUnion.create;
-var discriminatedUnionType = ZodDiscriminatedUnion.create;
-var intersectionType = ZodIntersection.create;
-var tupleType = ZodTuple.create;
-var recordType = ZodRecord.create;
-var mapType = ZodMap.create;
-var setType = ZodSet.create;
-var functionType = ZodFunction.create;
-var lazyType = ZodLazy.create;
-var literalType = ZodLiteral.create;
-var enumType = ZodEnum.create;
-var nativeEnumType = ZodNativeEnum.create;
-var promiseType = ZodPromise.create;
-var effectsType = ZodEffects.create;
-var optionalType = ZodOptional.create;
-var nullableType = ZodNullable.create;
-var preprocessType = ZodEffects.createWithPreprocess;
-var pipelineType = ZodPipeline.create;
-var NEVER = INVALID;
+async function resolveDefaultPackages() {
+  const env = process.env.AIDENT_PACKAGES?.trim() || process.env.AIDENT_PACKAGE?.trim();
+  if (env)
+    return normalizeCliPackages(env);
+  const config = await readConfig();
+  return normalizeCliPackages(config.packages ?? DEFAULT_CLI_PACKAGES);
+}
+async function resolveOriginClientName() {
+  const config = await readConfig();
+  return typeof config.originClientName === "string" && config.originClientName.trim() ? config.originClientName.trim() : null;
+}
+function isKnownConfigKey(key) {
+  return CONFIG_KEYS.includes(key);
+}
+function normalizeBaseUrl(url) {
+  let trimmed = url.trim();
+  if (!/^https?:\/\//i.test(trimmed))
+    trimmed = `https://${trimmed}`;
+  const normalized = trimmed.replace(/\/+$/, "");
+  const officialOrigin = /^https:\/\/([^/?#:@]+)$/i.exec(normalized);
+  const loadoutHost = getLoadoutHostForLegacyAidentHost(officialOrigin?.[1]);
+  return loadoutHost ? `https://${loadoutHost}` : normalized;
+}
+
 // ../web/shared/loadout/AidentSemver.ts
 var AIDENT_SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 var AidentSemverSchema = stringType().regex(AIDENT_SEMVER_RE);
@@ -7128,7 +7142,7 @@ function serializeLoadoutSkillPackage(skillPackage) {
 }
 
 // src/version.ts
-var VERSION = "0.3.1";
+var VERSION = "0.3.2-rc.ci.37567087135.1";
 var DESKTOP_VERSION = process.env.AIDENT_DESKTOP_VERSION?.trim() || undefined;
 var DESKTOP_CHANNEL = parseDesktopChannel(process.env.AIDENT_DESKTOP_CHANNEL);
 function parseDesktopChannel(value) {
@@ -8494,6 +8508,15 @@ var KNOWN_CLEAN_LOADOUT_SKILL_REQUIRED_FILE_GIT_BLOB_SHA1 = {
       "references/mcp.md": "4b59cce600b87e1ae2c7cbda8b61f79cd5776fc4",
       "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
     }
+  ],
+  "0.4.20": [
+    {
+      "SKILL.md": "bb6101455a28b865cbba127c9c9805b04372b561",
+      "references/api.md": "240b913e8c85492f2441326033db91747c54863e",
+      "references/loadout.md": "89e8370f3f70a6f0531151397b73ebd9da270c37",
+      "references/mcp.md": "4b59cce600b87e1ae2c7cbda8b61f79cd5776fc4",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
   ]
 };
 async function fetchLoadoutSkillMetadata(baseUrl, signal) {
@@ -8859,6 +8882,24 @@ class CliClient {
   async execOperation(packageName, operationId, args, options = {}) {
     return this.fetchJson("POST", this.operationPath(packageName, operationId), args, this.takeCatalogTimingHeaders(), options);
   }
+  async genDesktopSession(currentUserId) {
+    const response = await fetch(`${this.baseUrl}${LOADOUT_DESKTOP_SESSION_PATH}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${this.creds.access_token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ currentUserId }),
+      redirect: "error",
+      signal: AbortSignal.timeout(20000)
+    });
+    if (!response.ok)
+      return { status: response.status, body: { authenticated: false, cookies: [] } };
+    const { userId, unchanged } = LoadoutDesktopSessionResponseSchema.parse(await response.json());
+    const cookies = response.headers.getSetCookie();
+    if (unchanged && userId === currentUserId)
+      return { status: response.status, body: { authenticated: true, userId, unchanged, cookies: [] } };
+    if (cookies.length === 0)
+      throw new Error("Desktop sign-in exchange returned no session");
+    return { status: response.status, body: { authenticated: true, userId, cookies } };
+  }
   takeCatalogTimingHeaders() {
     if (this.catalogDurationMs === null)
       return;