@ainecto/cli 0.12.0 → 0.12.1

package/dist/bin/ainecto.js

@@ -175,6 +175,259 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/core/http/rateLimit.ts
+var RATE_LIMITED = "RATE_LIMITED";
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value === void 0) return void 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return representable(Number(trimmed), now);
+  if (!/[a-z]/i.test(trimmed)) return void 0;
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at)) return void 0;
+  return Math.max(0, Math.ceil((at - now) / 1e3));
+}
+function representable(seconds, now) {
+  return Number.isNaN(new Date(now + seconds * 1e3).getTime()) ? void 0 : seconds;
+}
+function rateLimitDetails(headerValue, body, now = Date.now()) {
+  const fields = isRecord2(body) ? body : {};
+  const fromBody = typeof fields.retryAfterSeconds === "number" && Number.isFinite(fields.retryAfterSeconds) && fields.retryAfterSeconds >= 0 ? representable(Math.ceil(fields.retryAfterSeconds), now) : void 0;
+  const retryAfterSeconds = fromBody ?? parseRetryAfter(headerValue, now);
+  return {
+    status: 429,
+    ...retryAfterSeconds !== void 0 ? { retryAfterSeconds, retryAt: new Date(now + retryAfterSeconds * 1e3).toISOString() } : {},
+    ...typeof fields.scope === "string" ? { scope: fields.scope } : {},
+    ...typeof fields.policyId === "string" ? { policyId: fields.policyId } : {}
+  };
+}
+function isRateLimitedRpcError(error) {
+  return isRecord2(error) && error.code === 429 && isRecord2(error.data) && error.data.code === RATE_LIMITED;
+}
+function rateLimitMessage(where, details) {
+  return details.retryAfterSeconds === void 0 ? `${where} was rate limited (HTTP 429). Wait before trying again.` : `${where} was rate limited (HTTP 429). Retry after ${details.retryAfterSeconds} seconds (${details.retryAt}).`;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/harness/legacyRole.ts
+var LEGACY_ROLE_HEADER = "X-AiNecto-Role";
+var LEGACY_ROLE_ENV_VAR = "AINECTO_ROLE";
+var LEGACY_ROLE_NOTICE = "AiNecto session roles were removed; access follows your AiNecto permissions. Re-run `ainecto init` to tidy this repository.";
+function legacyRoleInput(flag, envVars = process.env) {
+  const value = flag ?? envVars[LEGACY_ROLE_ENV_VAR];
+  return value !== void 0 && value.trim() ? value.trim() : void 0;
+}
+
+// src/core/version.ts
+var UNBUNDLED_VERSION = "dev";
+var CLI_VERSION = true ? "0.12.1" : UNBUNDLED_VERSION;
+var PACKAGE_NAME = "@ainecto/mcp";
+var CLI_USER_AGENT = `${PACKAGE_NAME} ${CLI_VERSION}`;
+function bridgePackageSpec(version = CLI_VERSION) {
+  return version === UNBUNDLED_VERSION ? PACKAGE_NAME : `${PACKAGE_NAME}@${version}`;
+}
+
+// src/core/mcp/rpcClient.ts
+var CHANNEL_HEADER = "X-AiNecto-Channel";
+var AGENT_HEADER = "X-AiNecto-Agent";
+var AGENT_NAME_HEADER = "X-AiNecto-Agent-Name";
+var MAX_AGENT_NAME_LENGTH = 100;
+var McpRpcError = class extends Error {
+  constructor(message, code, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+  }
+  code;
+  details;
+};
+var RateLimitedError = class extends McpRpcError {
+  constructor(message, rateLimit) {
+    super(message, RATE_LIMITED, rateLimit);
+    this.rateLimit = rateLimit;
+    this.name = "RateLimitedError";
+  }
+  rateLimit;
+};
+var McpRpcClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  options;
+  fetchImpl;
+  nextId = 1;
+  agent;
+  /**
+   * 브리지 전용 — 호스트 에이전트가 보낸 {@code initialize} 의 {@code clientInfo.name}(프로그램 고정 이름).
+   * 이후 모든 요청의 {@code X-AiNecto-Agent} 헤더로 싣는다. 직접 명령은 부르지 않는다(누가 셸을 돌렸는지 모른다).
+   */
+  useAgent(clientName) {
+    this.agent = agentHeaderValue(clientName);
+  }
+  initialize() {
+    return this.request("initialize", {
+      protocolVersion: "2024-11-05",
+      capabilities: {},
+      clientInfo: { name: PACKAGE_NAME, version: CLI_VERSION }
+    });
+  }
+  async toolsList() {
+    const result = await this.request("tools/list", {});
+    if (!isRecord3(result) || !Array.isArray(result.tools)) {
+      throw new McpRpcError("tools/list response did not include a tools array.", "MCP_PROTOCOL_ERROR", result);
+    }
+    return result.tools;
+  }
+  async toolsCall(name, args) {
+    return this.request("tools/call", { name, arguments: args ?? {} });
+  }
+  async request(method, params) {
+    const response = await this.sendRaw({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method,
+      params
+    });
+    if (!response) {
+      return void 0;
+    }
+    if ("error" in response) {
+      if (isRateLimitedRpcError(response.error)) {
+        const details = rateLimitDetails(void 0, response.error.data);
+        throw new RateLimitedError(rateLimitMessage(`MCP ${method}`, details), details);
+      }
+      throw new McpRpcError(response.error.message, "MCP_ERROR", response.error);
+    }
+    return response.result;
+  }
+  async sendRaw(request) {
+    const token = await this.options.tokenProvider?.getAccessToken();
+    let response = await this.postJson(request, token);
+    if (response.status === 401 && this.options.tokenProvider) {
+      const refreshed = await this.options.tokenProvider.refreshAfterUnauthorized();
+      if (refreshed) {
+        response = await this.postJson(request, refreshed);
+      }
+    }
+    if (response.status === 204 || response.status === 202) {
+      return void 0;
+    }
+    const text = await response.text();
+    if (response.status === 429) {
+      return rateLimitedResponse(text, response.headers.get("retry-after"));
+    }
+    if (!response.ok) {
+      const serverError = parseServerError(text);
+      throw new McpRpcError(
+        `MCP HTTP request failed with HTTP ${response.status}${serverError ? ` \u2014 ${describeServerError(serverError)}` : "."}`,
+        "MCP_HTTP_ERROR",
+        { ...httpErrorDetails(response.status, text, this.options.envVars ?? process.env), ...serverError ? { error: serverError.error } : {} }
+      );
+    }
+    if (!text.trim()) {
+      return void 0;
+    }
+    const parsed = JSON.parse(text);
+    if (!isJsonRpcResponse(parsed)) {
+      throw new McpRpcError("MCP response was not a JSON-RPC response.", "MCP_PROTOCOL_ERROR", parsed);
+    }
+    return parsed;
+  }
+  postJson(request, token) {
+    const headers = {
+      "content-type": "application/json",
+      accept: "application/json"
+    };
+    if (token) {
+      headers.authorization = `Bearer ${token}`;
+    }
+    const legacyRole = printableHeaderValue(this.options.legacyRole);
+    if (legacyRole) {
+      headers[LEGACY_ROLE_HEADER.toLowerCase()] = legacyRole;
+    }
+    headers[CHANNEL_HEADER.toLowerCase()] = this.options.channel;
+    if (this.agent) {
+      headers[AGENT_HEADER.toLowerCase()] = this.agent;
+    }
+    if (this.options.agentName) {
+      headers[AGENT_NAME_HEADER.toLowerCase()] = this.options.agentName;
+    }
+    return this.fetchImpl(this.options.endpoint, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(request)
+    });
+  }
+};
+function rateLimitedResponse(text, retryAfter) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = void 0;
+  }
+  if (isJsonRpcResponse(parsed) && "error" in parsed) {
+    const data = isRecord3(parsed.error.data) ? parsed.error.data : {};
+    const seconds = parseRetryAfter(retryAfter);
+    if (data.retryAfterSeconds === void 0 && seconds !== void 0) {
+      parsed.error.data = { ...data, retryAfterSeconds: seconds };
+    }
+    return parsed;
+  }
+  const details = rateLimitDetails(retryAfter, parsed);
+  throw new RateLimitedError(rateLimitMessage("MCP HTTP request", details), details);
+}
+function isToolError(result) {
+  return isRecord3(result) && result.isError === true;
+}
+function agentHeaderValue(clientName) {
+  return printableHeaderValue(clientName);
+}
+function printableHeaderValue(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const printable = value.replace(/[^\x20-\x7E]/g, "").trim().slice(0, MAX_AGENT_NAME_LENGTH).trim();
+  return printable || void 0;
+}
+function parseServerError(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord3(parsed) || typeof parsed.error !== "string" || !parsed.error.trim()) {
+    return void 0;
+  }
+  return {
+    error: parsed.error.trim(),
+    description: typeof parsed.error_description === "string" && parsed.error_description.trim() ? parsed.error_description : void 0
+  };
+}
+function describeServerError(serverError) {
+  const line = serverError.description ? `${serverError.error}: ${serverError.description}` : serverError.error;
+  return line.replace(/\s+/g, " ").trim();
+}
+function isJsonRpcResponse(value) {
+  return isRecord3(value) && value.jsonrpc === "2.0" && ("result" in value || "error" in value);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function httpErrorDetails(status, body, envVars) {
+  const details = { status };
+  if (envVars.AINECTO_CLI_DEBUG === "1" || envVars.AINECTO_DEBUG === "1") {
+    details.body = safeBodyPreview(body);
+  }
+  return details;
+}
+function safeBodyPreview(body) {
+  return body.length > 500 ? `${body.slice(0, 500)}...` : body;
+}
+
 // src/core/auth/oauth.ts
 var DEFAULT_LOGIN_TIMEOUT_MS = 3e5;
 var OAuthLoginError = class extends Error {
@@ -388,6 +641,10 @@ async function exchangeToken(tokenEndpoint, params, fetchImpl) {
     headers: { "content-type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams(params)
   });
+  if (response.status === 429) {
+    const details = rateLimitDetails(response.headers.get("retry-after"), await readJsonObject(response));
+    throw new RateLimitedError(rateLimitMessage("OAuth token request", details), details);
+  }
   if (!response.ok) {
     const oauthError = await readOAuthErrorCode(response);
     if (params.grant_type === "refresh_token" && oauthError !== void 0 && REAUTH_REQUIRED_ERRORS.has(oauthError)) {
@@ -397,6 +654,13 @@ async function exchangeToken(tokenEndpoint, params, fetchImpl) {
   }
   return response.json();
 }
+async function readJsonObject(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
 async function readOAuthErrorCode(response) {
   try {
     const body = await response.json();
@@ -612,191 +876,6 @@ async function readAllStdin(stdin) {
   return text;
 }
 
-// src/core/harness/legacyRole.ts
-var LEGACY_ROLE_HEADER = "X-AiNecto-Role";
-var LEGACY_ROLE_ENV_VAR = "AINECTO_ROLE";
-var LEGACY_ROLE_NOTICE = "AiNecto session roles were removed; access follows your AiNecto permissions. Re-run `ainecto init` to tidy this repository.";
-function legacyRoleInput(flag, envVars = process.env) {
-  const value = flag ?? envVars[LEGACY_ROLE_ENV_VAR];
-  return value !== void 0 && value.trim() ? value.trim() : void 0;
-}
-
-// src/core/version.ts
-var UNBUNDLED_VERSION = "dev";
-var CLI_VERSION = true ? "0.12.0" : UNBUNDLED_VERSION;
-var PACKAGE_NAME = "@ainecto/mcp";
-var CLI_USER_AGENT = `${PACKAGE_NAME} ${CLI_VERSION}`;
-function bridgePackageSpec(version = CLI_VERSION) {
-  return version === UNBUNDLED_VERSION ? PACKAGE_NAME : `${PACKAGE_NAME}@${version}`;
-}
-
-// src/core/mcp/rpcClient.ts
-var CHANNEL_HEADER = "X-AiNecto-Channel";
-var AGENT_HEADER = "X-AiNecto-Agent";
-var AGENT_NAME_HEADER = "X-AiNecto-Agent-Name";
-var MAX_AGENT_NAME_LENGTH = 100;
-var McpRpcError = class extends Error {
-  constructor(message, code, details) {
-    super(message);
-    this.code = code;
-    this.details = details;
-  }
-  code;
-  details;
-};
-var McpRpcClient = class {
-  constructor(options) {
-    this.options = options;
-    this.fetchImpl = options.fetchImpl ?? fetch;
-  }
-  options;
-  fetchImpl;
-  nextId = 1;
-  agent;
-  /**
-   * 브리지 전용 — 호스트 에이전트가 보낸 {@code initialize} 의 {@code clientInfo.name}(프로그램 고정 이름).
-   * 이후 모든 요청의 {@code X-AiNecto-Agent} 헤더로 싣는다. 직접 명령은 부르지 않는다(누가 셸을 돌렸는지 모른다).
-   */
-  useAgent(clientName) {
-    this.agent = agentHeaderValue(clientName);
-  }
-  initialize() {
-    return this.request("initialize", {
-      protocolVersion: "2024-11-05",
-      capabilities: {},
-      clientInfo: { name: PACKAGE_NAME, version: CLI_VERSION }
-    });
-  }
-  async toolsList() {
-    const result = await this.request("tools/list", {});
-    if (!isRecord2(result) || !Array.isArray(result.tools)) {
-      throw new McpRpcError("tools/list response did not include a tools array.", "MCP_PROTOCOL_ERROR", result);
-    }
-    return result.tools;
-  }
-  async toolsCall(name, args) {
-    return this.request("tools/call", { name, arguments: args ?? {} });
-  }
-  async request(method, params) {
-    const response = await this.sendRaw({
-      jsonrpc: "2.0",
-      id: this.nextId++,
-      method,
-      params
-    });
-    if (!response) {
-      return void 0;
-    }
-    if ("error" in response) {
-      throw new McpRpcError(response.error.message, "MCP_ERROR", response.error);
-    }
-    return response.result;
-  }
-  async sendRaw(request) {
-    const token = await this.options.tokenProvider?.getAccessToken();
-    let response = await this.postJson(request, token);
-    if (response.status === 401 && this.options.tokenProvider) {
-      const refreshed = await this.options.tokenProvider.refreshAfterUnauthorized();
-      if (refreshed) {
-        response = await this.postJson(request, refreshed);
-      }
-    }
-    if (response.status === 204 || response.status === 202) {
-      return void 0;
-    }
-    const text = await response.text();
-    if (!response.ok) {
-      const serverError = parseServerError(text);
-      throw new McpRpcError(
-        `MCP HTTP request failed with HTTP ${response.status}${serverError ? ` \u2014 ${describeServerError(serverError)}` : "."}`,
-        "MCP_HTTP_ERROR",
-        { ...httpErrorDetails(response.status, text, this.options.envVars ?? process.env), ...serverError ? { error: serverError.error } : {} }
-      );
-    }
-    if (!text.trim()) {
-      return void 0;
-    }
-    const parsed = JSON.parse(text);
-    if (!isJsonRpcResponse(parsed)) {
-      throw new McpRpcError("MCP response was not a JSON-RPC response.", "MCP_PROTOCOL_ERROR", parsed);
-    }
-    return parsed;
-  }
-  postJson(request, token) {
-    const headers = {
-      "content-type": "application/json",
-      accept: "application/json"
-    };
-    if (token) {
-      headers.authorization = `Bearer ${token}`;
-    }
-    const legacyRole = printableHeaderValue(this.options.legacyRole);
-    if (legacyRole) {
-      headers[LEGACY_ROLE_HEADER.toLowerCase()] = legacyRole;
-    }
-    headers[CHANNEL_HEADER.toLowerCase()] = this.options.channel;
-    if (this.agent) {
-      headers[AGENT_HEADER.toLowerCase()] = this.agent;
-    }
-    if (this.options.agentName) {
-      headers[AGENT_NAME_HEADER.toLowerCase()] = this.options.agentName;
-    }
-    return this.fetchImpl(this.options.endpoint, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(request)
-    });
-  }
-};
-function isToolError(result) {
-  return isRecord2(result) && result.isError === true;
-}
-function agentHeaderValue(clientName) {
-  return printableHeaderValue(clientName);
-}
-function printableHeaderValue(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  const printable = value.replace(/[^\x20-\x7E]/g, "").trim().slice(0, MAX_AGENT_NAME_LENGTH).trim();
-  return printable || void 0;
-}
-function parseServerError(body) {
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    return void 0;
-  }
-  if (!isRecord2(parsed) || typeof parsed.error !== "string" || !parsed.error.trim()) {
-    return void 0;
-  }
-  return {
-    error: parsed.error.trim(),
-    description: typeof parsed.error_description === "string" && parsed.error_description.trim() ? parsed.error_description : void 0
-  };
-}
-function describeServerError(serverError) {
-  const line = serverError.description ? `${serverError.error}: ${serverError.description}` : serverError.error;
-  return line.replace(/\s+/g, " ").trim();
-}
-function isJsonRpcResponse(value) {
-  return isRecord2(value) && value.jsonrpc === "2.0" && ("result" in value || "error" in value);
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function httpErrorDetails(status, body, envVars) {
-  const details = { status };
-  if (envVars.AINECTO_CLI_DEBUG === "1" || envVars.AINECTO_DEBUG === "1") {
-    details.body = safeBodyPreview(body);
-  }
-  return details;
-}
-function safeBodyPreview(body) {
-  return body.length > 500 ? `${body.slice(0, 500)}...` : body;
-}
-
 // src/core/output/render.ts
 function renderSuccess(data, options = {}) {
   if (options.json) {
@@ -1159,7 +1238,7 @@ function inferPayloadMode(strippedName, inputSchema) {
     return "binary-upload";
   }
   const properties = inputSchema.properties;
-  if (!isRecord3(properties)) {
+  if (!isRecord4(properties)) {
     return "flags";
   }
   const values = Object.values(properties);
@@ -1188,7 +1267,7 @@ function stableStringify(value) {
   if (Array.isArray(value)) {
     return `[${value.map(stableStringify).join(",")}]`;
   }
-  if (isRecord3(value)) {
+  if (isRecord4(value)) {
     return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
   }
   return JSON.stringify(value);
@@ -1197,7 +1276,7 @@ function normalizeSchema(schema) {
   return JSON.parse(stableStringify(schema));
 }
 function isScalarSchema(value) {
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return false;
   }
   const type = value.type;
@@ -1220,7 +1299,7 @@ function isVerb(value) {
 function snakeToKebab(value) {
   return value.replaceAll("_", "-");
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -1261,15 +1340,16 @@ async function runStdioBridge(options) {
 `);
         continue;
       }
-      writeLine(options.output, failure(request.id, INTERNAL_ERROR, error));
+      writeLine(options.output, failure(request.id, error instanceof RateLimitedError ? RATE_LIMITED_CODE : INTERNAL_ERROR, error));
     }
   }
 }
 var PARSE_ERROR = -32700;
 var INVALID_REQUEST = -32600;
 var INTERNAL_ERROR = -32603;
+var RATE_LIMITED_CODE = 429;
 function failure(id, code, error) {
-  const data = error instanceof McpRpcError ? { code: error.code, ...isRecord4(error.details) ? error.details : {} } : void 0;
+  const data = error instanceof McpRpcError ? { code: error.code, ...isRecord5(error.details) ? error.details : {} } : void 0;
   return {
     jsonrpc: "2.0",
     id,
@@ -1285,7 +1365,7 @@ function writeLine(output, message) {
 }
 function parseJsonRpcRequest(line) {
   const parsed = JSON.parse(line);
-  if (!isRecord4(parsed) || parsed.jsonrpc !== "2.0" || typeof parsed.method !== "string") {
+  if (!isRecord5(parsed) || parsed.jsonrpc !== "2.0" || typeof parsed.method !== "string") {
     throw new Error("Invalid JSON-RPC request.");
   }
   return {
@@ -1296,9 +1376,9 @@ function parseJsonRpcRequest(line) {
   };
 }
 function clientInfoName(params) {
-  return isRecord4(params) && isRecord4(params.clientInfo) ? params.clientInfo.name : void 0;
+  return isRecord5(params) && isRecord5(params.clientInfo) ? params.clientInfo.name : void 0;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -1338,7 +1418,7 @@ function renderCodexConfig(entry) {
 `;
 }
 function isOurEntry(entry, endpoint) {
-  if (isRecord5(entry) && typeof entry.url === "string") {
+  if (isRecord6(entry) && typeof entry.url === "string") {
     const url = normalizedServerUrl(entry.url);
     return url !== void 0 && (url === endpoint || isDefaultEndpoint(url));
   }
@@ -1365,10 +1445,10 @@ function buildServerEntry(input = {}) {
   return { command: "npx", args };
 }
 function entryCarriesRole(entry) {
-  return isRecord5(entry) && Array.isArray(entry.args) && entry.args.includes("--role");
+  return isRecord6(entry) && Array.isArray(entry.args) && entry.args.includes("--role");
 }
 function pinnedBridgeVersion(entry) {
-  if (!isRecord5(entry) || !Array.isArray(entry.args)) {
+  if (!isRecord6(entry) || !Array.isArray(entry.args)) {
     return void 0;
   }
   const pinned = entry.args.find((arg) => typeof arg === "string" && arg.startsWith(`${PACKAGE_NAME}@`));
@@ -1381,13 +1461,13 @@ function readServerEntry(existing) {
   try {
     const parsed = JSON.parse(existing);
     const servers = parsed?.mcpServers;
-    return isRecord5(servers) ? servers[SERVER_NAME] : void 0;
+    return isRecord6(servers) ? servers[SERVER_NAME] : void 0;
   } catch {
     return void 0;
   }
 }
 function isOurBridge(entry) {
-  if (!isRecord5(entry)) {
+  if (!isRecord6(entry)) {
     return false;
   }
   const { command, args } = entry;
@@ -1431,7 +1511,7 @@ function readServers(root) {
   if (servers === void 0) {
     return {};
   }
-  if (!isRecord5(servers)) {
+  if (!isRecord6(servers)) {
     throw new Error(
       'Existing MCP config has an "mcpServers" value that is not an object, so it was left untouched. Fix it by hand and run init again.'
     );
@@ -1450,7 +1530,7 @@ function parseConfigObject(existing) {
       `Existing MCP config is not valid JSON, so it was left untouched. Fix it by hand and run init again. (${error instanceof Error ? error.message : String(error)})`
     );
   }
-  if (!isRecord5(parsed)) {
+  if (!isRecord6(parsed)) {
     throw new Error("Existing MCP config must be a JSON object; it was left untouched.");
   }
   return parsed;
@@ -1459,7 +1539,7 @@ function stringify(value) {
   return `${JSON.stringify(value, null, 2)}
 `;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -1977,7 +2057,7 @@ var enrichments = [
 // src/core/output/table.ts
 function renderTable(data, options = {}) {
   const rows = extractRows(data);
-  if (!rows.length || !rows.every(isRecord6)) {
+  if (!rows.length || !rows.every(isRecord7)) {
     return void 0;
   }
   const columns = options.columns?.length ? options.columns : inferColumns(rows);
@@ -1994,7 +2074,7 @@ function extractRows(data) {
   if (Array.isArray(data)) {
     return data;
   }
-  if (isRecord6(data)) {
+  if (isRecord7(data)) {
     for (const key of ["items", "projects", "workspaces", "folders", "documents", "tasks", "attachments", "results", "data"]) {
       const value = data[key];
       if (Array.isArray(value)) {
@@ -2022,7 +2102,7 @@ function formatCell(value) {
   }
   return String(value);
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -2075,7 +2155,7 @@ function payloadToArgs(value) {
   if (value === void 0 || value === null) {
     return {};
   }
-  if (!isRecord7(value)) {
+  if (!isRecord8(value)) {
     throw new CliCommandError("INVALID_PAYLOAD", "Generated command payload must be a JSON object.", { value });
   }
   return { ...value };
@@ -2179,12 +2259,12 @@ function coerceFlagValue(value, schema, key) {
 }
 function getSchemaProperties(schema) {
   const properties = schema.properties;
-  if (!isRecord7(properties)) {
+  if (!isRecord8(properties)) {
     return {};
   }
   const result = {};
   for (const [key, value] of Object.entries(properties)) {
-    if (isRecord7(value)) {
+    if (isRecord8(value)) {
       result[key] = value;
     }
   }
@@ -2199,7 +2279,7 @@ function requireValue(flag, value) {
   }
   return value;
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -2330,10 +2410,10 @@ import { basename as basename2, extname } from "path";
 
 // src/core/mcp/toolPayload.ts
 function unwrapMcpToolPayload(value) {
-  if (!isRecord8(value) || !Array.isArray(value.content)) {
+  if (!isRecord9(value) || !Array.isArray(value.content)) {
     return value;
   }
-  const text = value.content.map((item) => isRecord8(item) && typeof item.text === "string" ? item.text : "").find((itemText) => itemText.trim().startsWith("{"));
+  const text = value.content.map((item) => isRecord9(item) && typeof item.text === "string" ? item.text : "").find((itemText) => itemText.trim().startsWith("{"));
   if (!text) {
     return value;
   }
@@ -2344,23 +2424,23 @@ function unwrapMcpToolPayload(value) {
   }
 }
 function toolErrorText(value) {
-  if (!isRecord8(value) || !Array.isArray(value.content)) {
+  if (!isRecord9(value) || !Array.isArray(value.content)) {
     return "The tool returned an error.";
   }
-  const text = value.content.map((item) => isRecord8(item) && typeof item.text === "string" ? item.text : "").filter(Boolean).join("\n");
+  const text = value.content.map((item) => isRecord9(item) && typeof item.text === "string" ? item.text : "").filter(Boolean).join("\n");
   return text || "The tool returned an error.";
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function extractProjects(value) {
-  const candidates = Array.isArray(value) ? value : isRecord8(value) ? ["projects", "items", "created", "data", "hits"].flatMap((key) => {
+  const candidates = Array.isArray(value) ? value : isRecord9(value) ? ["projects", "items", "created", "data", "hits"].flatMap((key) => {
     const nested = value[key];
     return Array.isArray(nested) ? nested : [];
   }) : [];
   const projects = [];
   for (const candidate of candidates) {
-    if (isRecord8(candidate) && typeof candidate.uuid === "string") {
+    if (isRecord9(candidate) && typeof candidate.uuid === "string") {
       projects.push({
         uuid: candidate.uuid,
         name: typeof candidate.name === "string" ? candidate.name : candidate.uuid
@@ -2468,7 +2548,7 @@ async function requestUploadToken(client, metadata, context) {
     requestArgs.ttlSeconds = context.ttlSeconds;
   }
   const response = unwrapMcpToolPayload(await client.toolsCall(context.requestToolName, requestArgs));
-  if (!isRecord9(response)) {
+  if (!isRecord10(response)) {
     throw new AttachmentUploadError("UPLOAD_TOKEN_PROTOCOL_ERROR", "request_upload_token response was not an object.");
   }
   const token = response.token;
@@ -2489,8 +2569,9 @@ async function putAttachmentBytes(token, metadata, fetchImpl) {
   const maxAttempts = 3;
   let lastRetryableError;
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    let response;
     try {
-      const response = await fetchImpl(token.uploadUrl, {
+      response = await fetchImpl(token.uploadUrl, {
         method: "PUT",
         headers: {
           authorization: `Bearer ${token.token}`,
@@ -2498,22 +2579,27 @@ async function putAttachmentBytes(token, metadata, fetchImpl) {
         },
         body: new Uint8Array(metadata.bytes)
       });
-      if (shouldRetryResponse(response.status) && attempt < maxAttempts) {
-        continue;
-      }
-      if (!response.ok) {
-        throw uploadHttpError(response.status);
-      }
-      return parsePutResponse(await response.text());
     } catch (error) {
-      if (error instanceof AttachmentUploadError) {
-        throw error;
-      }
       lastRetryableError = error;
-      if (attempt === maxAttempts) {
-        break;
-      }
+      continue;
+    }
+    if (response.status === 429) {
+      throw await uploadRateLimited(response);
+    }
+    if (shouldRetryResponse(response.status) && attempt < maxAttempts) {
+      continue;
+    }
+    if (!response.ok) {
+      throw uploadHttpError(response.status);
+    }
+    let text;
+    try {
+      text = await response.text();
+    } catch (error) {
+      lastRetryableError = error;
+      continue;
     }
+    return parsePutResponse(text);
   }
   throw new AttachmentUploadError("ATTACHMENT_UPLOAD_FAILED", "Attachment upload failed.", {
     cause: lastRetryableError instanceof Error ? lastRetryableError.message : String(lastRetryableError)
@@ -2529,7 +2615,17 @@ function uploadHttpError(status) {
   return new AttachmentUploadError("ATTACHMENT_UPLOAD_HTTP_ERROR", `Attachment upload failed with HTTP ${status}.`, { status });
 }
 function shouldRetryResponse(status) {
-  return status === 429 || status >= 500;
+  return status >= 500;
+}
+async function uploadRateLimited(response) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    body = void 0;
+  }
+  const details = rateLimitDetails(response.headers.get("retry-after"), body);
+  return new AttachmentUploadError(RATE_LIMITED, rateLimitMessage("Attachment upload", details), details);
 }
 function parsePutResponse(text) {
   let parsed;
@@ -2538,7 +2634,7 @@ function parsePutResponse(text) {
   } catch {
     throw new AttachmentUploadError("ATTACHMENT_UPLOAD_PROTOCOL_ERROR", "Attachment PUT response was not valid JSON.");
   }
-  if (!isRecord9(parsed)) {
+  if (!isRecord10(parsed)) {
     throw new AttachmentUploadError("ATTACHMENT_UPLOAD_PROTOCOL_ERROR", "Attachment PUT response was not an object.");
   }
   if (typeof parsed.storageKey !== "string") {
@@ -2602,7 +2698,7 @@ var MIME_BY_EXTENSION = {
   ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
   ".zip": "application/zip"
 };
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -2834,7 +2930,7 @@ async function agentTodosPoll(options) {
   let after;
   for (let page = 0; page < 20; page += 1) {
     const result = await callTool(options.client, LIST_AGENT_TODOS, { state: ["OPEN"], ...scope, limit: 50, ...after ? { after } : {} });
-    const pageItems = Array.isArray(result.items) ? result.items.filter(isRecord10) : [];
+    const pageItems = Array.isArray(result.items) ? result.items.filter(isRecord11) : [];
     items.push(...pageItems);
     const last = pageItems[pageItems.length - 1];
     if (result.hasMore !== true || !last || typeof last.todoId !== "string") break;
@@ -2859,7 +2955,7 @@ async function callTool(client, name, args) {
     throw new CliCommandError("TOOL_ERROR", toolErrorText(raw), { tool: name });
   }
   const payload = unwrapMcpToolPayload(raw);
-  if (!isRecord10(payload)) {
+  if (!isRecord11(payload)) {
     throw new CliCommandError("MCP_PROTOCOL_ERROR", `${name} did not return an object.`, { tool: name });
   }
   return payload;
@@ -2934,7 +3030,7 @@ async function readCursorFile(path) {
   if (text === void 0 || !text.trim()) return void 0;
   try {
     const parsed = JSON.parse(text);
-    if (parsed?.v !== 1 || !isRecord10(parsed.filter)) throw new Error("shape");
+    if (parsed?.v !== 1 || !isRecord11(parsed.filter)) throw new Error("shape");
     return { ...parsed, filter: normalizeSavedFilter(parsed.filter) };
   } catch {
     throw new CliCommandError("INVALID_CURSOR_FILE", `${path} is not a cursor file written by ainecto notifications poll.`, { cursorFile: path });
@@ -2969,7 +3065,7 @@ async function writeJsonAtomic(path, value) {
   }
   await rename2(temp, path);
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -3985,9 +4081,9 @@ async function applyPlan(root, plan, dryRun, snapshot, recordFirst = true) {
   }
   const applied = [];
   try {
-    const isRecord12 = (path) => !recordFirst && path === HARNESS_RECORD_PATH;
-    const recordWrites = plan.writes.filter((write) => isRecord12(write.path));
-    const recordDeletes = plan.deletes.filter((path) => isRecord12(path));
+    const isRecord13 = (path) => !recordFirst && path === HARNESS_RECORD_PATH;
+    const recordWrites = plan.writes.filter((write) => isRecord13(write.path));
+    const recordDeletes = plan.deletes.filter((path) => isRecord13(path));
     const createdDirectories = [...plan.record?.createdDirectories ?? []];
     const rememberDirectories = (directories) => {
       for (const directory of directories) {
@@ -4029,8 +4125,8 @@ async function applyPlan(root, plan, dryRun, snapshot, recordFirst = true) {
     };
     try {
       await apply(
-        orderedWrites(plan.writes.filter((write) => !isRecord12(write.path)), recordFirst),
-        plan.deletes.filter((path) => !isRecord12(path))
+        orderedWrites(plan.writes.filter((write) => !isRecord13(write.path)), recordFirst),
+        plan.deletes.filter((path) => !isRecord13(path))
       );
       await recordDirectoriesOrExplain(false);
       await apply(recordWrites, recordDeletes);
@@ -4101,7 +4197,7 @@ async function fileMode(absolutePath) {
   try {
     return (await stat3(absolutePath)).mode & 4095;
   } catch (error) {
-    if (isRecord11(error) && error.code === "ENOENT") {
+    if (isRecord12(error) && error.code === "ENOENT") {
       return void 0;
     }
     throw error;
@@ -4144,7 +4240,7 @@ function parseInitArgs(argv) {
   }
   return args;
 }
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }