@alan-ai-hq/agent-manager-linux-arm64 0.1.144 → 0.1.146

package/alan-holder.cjs

@@ -20506,7 +20506,9 @@ var init_machine_identity = __esm({
     runCodexCredentialSchema = external_exports.object({
       accessToken: external_exports.string().min(1),
       chatgptAccountId: external_exports.string().min(1),
-      chatgptPlanType: external_exports.string().nullable()
+      chatgptPlanType: external_exports.string().nullable(),
+      credentialId: external_exports.uuid().optional(),
+      providerUserId: external_exports.string().min(1).optional()
     });
     runCodexCredentialRefreshRequestSchema = external_exports.object({
       /** sha256 hex of the access token Codex was refused with; a newer stored token is returned instead of rotating. */
@@ -20515,7 +20517,7 @@ var init_machine_identity = __esm({
     runProviderCredentialSchema = external_exports.object({
       /** Environment variables for the agent CLI, e.g. ANTHROPIC_API_KEY; empty when the CLI's own login is used. */
       env: external_exports.record(external_exports.string(), external_exports.string()),
-      /** The team's Codex login for a cloud sandbox; absent where the CLI's own login is used. */
+      /** The bound Codex login for a cloud sandbox; absent where the CLI's own login is used. */
       codex: runCodexCredentialSchema.optional()
     });
   }
@@ -20930,16 +20932,50 @@ var init_problem = __esm({
   }
 });
 
+// ../shared/dist/cli-usage.js
+var usagePercentSchema, usageTimestampSchema, cliUsageWindowPatchSchema, cliUsageWindowSchema, cliUsageBucketSchema, cliUsageSnapshotSchema;
+var init_cli_usage = __esm({
+  "../shared/dist/cli-usage.js"() {
+    "use strict";
+    init_zod();
+    usagePercentSchema = external_exports.number().min(0).max(100);
+    usageTimestampSchema = external_exports.iso.datetime();
+    cliUsageWindowPatchSchema = external_exports.object({
+      usedPercent: usagePercentSchema.nullable().optional(),
+      windowMinutes: external_exports.number().positive().nullable().optional(),
+      resetsAt: usageTimestampSchema.nullable().optional()
+    });
+    cliUsageWindowSchema = external_exports.object({
+      usedPercent: usagePercentSchema.optional(),
+      windowMinutes: external_exports.number().positive().optional(),
+      resetsAt: usageTimestampSchema.optional(),
+      observedAt: usageTimestampSchema,
+      receivedAt: usageTimestampSchema,
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    });
+    cliUsageBucketSchema = external_exports.object({
+      primary: cliUsageWindowSchema.optional(),
+      secondary: cliUsageWindowSchema.optional(),
+      planType: external_exports.string().min(1).nullable().optional()
+    });
+    cliUsageSnapshotSchema = external_exports.object({
+      buckets: external_exports.record(external_exports.string().min(1), cliUsageBucketSchema)
+    });
+  }
+});
+
 // ../shared/dist/runtime-v2/run-log.js
 function isRunLifecycleKind(sessionUpdate) {
   return RUN_LIFECYCLE_KINDS.has(sessionUpdate);
 }
-var runAcceptedUpdateSchema, runStartedUpdateSchema, runWorkspaceRelocatedUpdateSchema, runOutcomeSchema, runRejectionCodeSchema, runEndedUpdateSchema, runLifecycleUpdateSchema, RUN_LIFECYCLE_KINDS, runLogRecordSchema;
+var runAcceptedUpdateSchema, runStartedUpdateSchema, runCodexRateLimitsUpdateSchema, runWorkspaceRelocatedUpdateSchema, runOutcomeSchema, runRejectionCodeSchema, runEndedUpdateSchema, runLifecycleUpdateSchema, RUN_LIFECYCLE_KINDS, runLogRecordSchema;
 var init_run_log = __esm({
   "../shared/dist/runtime-v2/run-log.js"() {
     "use strict";
     init_zod();
     init_problem();
+    init_cli_usage();
     init_ids();
     runAcceptedUpdateSchema = external_exports.object({
       sessionUpdate: external_exports.literal("_alan/run.accepted"),
@@ -20951,6 +20987,16 @@ var init_run_log = __esm({
       providerSessionId: external_exports.string().min(1).optional(),
       pid: external_exports.number().int().positive().optional()
     });
+    runCodexRateLimitsUpdateSchema = external_exports.object({
+      sessionUpdate: external_exports.literal("_alan/codex.rate_limits"),
+      limitId: external_exports.string().min(1),
+      primary: cliUsageWindowPatchSchema.nullable().optional(),
+      secondary: cliUsageWindowPatchSchema.nullable().optional(),
+      planType: external_exports.string().min(1).nullable().optional(),
+      observedAt: external_exports.iso.datetime(),
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    });
     runWorkspaceRelocatedUpdateSchema = external_exports.object({
       sessionUpdate: external_exports.literal("_alan/run.workspace_relocated"),
       previousPath: external_exports.string().min(1).max(4096),
@@ -21013,7 +21059,7 @@ var init_holder_protocol = __esm({
     init_ids();
     init_link();
     init_run_log();
-    HOLDER_PROTOCOL = 1;
+    HOLDER_PROTOCOL = 2;
     holderAbortOutcomeSchema = external_exports.enum(["aborted", "interrupted"]);
     holderRequestSchema = external_exports.discriminatedUnion("type", [
       external_exports.object({ type: external_exports.literal("auth"), token: external_exports.string().min(1) }),
@@ -23663,6 +23709,13 @@ var init_notice_visibility = __esm({
   }
 });
 
+// ../shared/dist/agent/acp/presentation/turn-artifacts.js
+var init_turn_artifacts = __esm({
+  "../shared/dist/agent/acp/presentation/turn-artifacts.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/agent/acp/presentation/prepare-conversation-turns.js
 var init_prepare_conversation_turns = __esm({
   "../shared/dist/agent/acp/presentation/prepare-conversation-turns.js"() {
@@ -23753,6 +23806,7 @@ var init_acp = __esm({
     init_notice_visibility();
     init_prepare_conversation_turns();
     init_terminal_events();
+    init_turn_artifacts();
     init_types3();
     init_read();
     init_reduce();
@@ -24133,7 +24187,18 @@ var init_chunk_SBT5W7L4 = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-54ZRJOQP.js
+// ../agent-core/dist/chunk-HBIPWAUI.js
+function readCapReset(text2) {
+  const epoch = EPOCH_RESET.exec(text2);
+  if (epoch) return { resetsAt: new Date(Number(epoch[1]) * 1e3).toISOString() };
+  const codex = CODEX_RESET.exec(text2);
+  if (codex) {
+    const milliseconds = Date.parse(codex[1].replace(/(\d)(?:st|nd|rd|th)\b/gi, "$1"));
+    if (Number.isFinite(milliseconds)) return { resetsAt: new Date(milliseconds).toISOString() };
+  }
+  const worded = WORDED_RESET.exec(text2);
+  return worded ? { resetHint: worded[1].trim() } : {};
+}
 function specForErrorKind(errorKind) {
   const spec = ERROR_SPECS[errorKind];
   return { message: spec.message, errorKind, recoveryClass: spec.recoveryClass };
@@ -24194,15 +24259,6 @@ function normalizeCodexCliErrorMessage(message) {
   }
   return message;
 }
-function readCapReset(text2) {
-  const epoch = EPOCH_RESET.exec(text2);
-  if (epoch) {
-    const seconds = Number(epoch[1]);
-    return { resetsAt: new Date(seconds * 1e3).toISOString() };
-  }
-  const worded = WORDED_RESET.exec(text2);
-  return worded ? { resetHint: worded[1].trim() } : {};
-}
 function lineMatching(text2, pattern) {
   return text2.split("\n").map((line) => line.trim()).find((line) => pattern.test(line));
 }
@@ -24214,10 +24270,11 @@ function withCapReset(classified, text2) {
   if (classified.errorKind !== "usage_limit") return classified;
   const reset = readCapReset(text2);
   if (reset.resetsAt) {
+    const own22 = lineMatching(text2, /\btry again at\b/i);
     return {
       ...classified,
       ...reset,
-      message: `Provider usage limit reached. It resets at ${reset.resetsAt}; switch model or wait, then retry.`
+      message: own22 ?? `Provider usage limit reached. It resets at ${reset.resetsAt}; switch model or wait, then retry.`
     };
   }
   const own2 = lineMatching(text2, /usage limit/i);
@@ -24336,13 +24393,16 @@ function createCliProblem(observed, options) {
     ...classified.resetsAt ? { resetsAt: classified.resetsAt } : {}
   });
 }
-var import_crypto2, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
-var init_chunk_54ZRJOQP = __esm({
-  "../agent-core/dist/chunk-54ZRJOQP.js"() {
+var import_crypto2, EPOCH_RESET, WORDED_RESET, CODEX_RESET, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
+var init_chunk_HBIPWAUI = __esm({
+  "../agent-core/dist/chunk-HBIPWAUI.js"() {
     "use strict";
     init_chunk_YXWJW7I5();
     import_crypto2 = require("crypto");
     init_agent2();
+    EPOCH_RESET = /\|\s*(\d{10})\b/;
+    WORDED_RESET = /\bresets?\s+(?:at\s+)?([^.\n]{1,60}?)\s*(?:$|[.\n])/i;
+    CODEX_RESET = /\btry again at\s+([A-Za-z]{3,9}\s+\d{1,2}(?:st|nd|rd|th)?,?\s+\d{4}\s+\d{1,2}:\d{2}\s*[AP]M(?:\s+(?:UTC|GMT)(?:[+-]\d{1,2}(?::?\d{2})?)?)?)/i;
     ERROR_SPECS = {
       model_mismatch: {
         message: "The selected model isn't available, or you don't have access to it. Pick a different model, then send your message again.",
@@ -24496,7 +24556,7 @@ var init_chunk_54ZRJOQP = __esm({
       // #44604), or a trailing assistant message (opencode #19517).
       {
         kind: "history_rejected",
-        pattern: /\btext content blocks must be non-empty\b|\bcontent field in the message object\b|\bids were found without `?tool_result`? blocks\b|\bunexpected `?tool_use_id`?|\btool use concurrency issues\b|\bno tool output found for\b|\bdoes not support assistant message prefill\b/
+        pattern: /\btext content blocks must be non-empty\b|\bcontent field in the message object\b|\bids were found without `?tool_result`? blocks\b|\bunexpected `?tool_use_id`?|\btool use concurrency issues\b|\bno tool output found for\b|\bdoes not support assistant message prefill\b|\binvalid_encrypted_content\b|organization_id did not match the target organization/
       },
       // Claude: "No conversation found with session ID"; Codex: "no rollout found for thread id";
       // Copilot: "No session, task, or name matched"; Kimi/Cursor ACP: `Session "<id>" not found`.
@@ -24545,8 +24605,6 @@ var init_chunk_54ZRJOQP = __esm({
     ];
     CODEX_TIMEOUT_MESSAGE = "Codex connection to OpenAI timed out while waiting for the turn to continue. Retry the message; if it repeats, check network/API latency or reduce slow MCP/tool calls in the turn.";
     CODEX_EXPIRED_MESSAGE = "Codex CLI connection expired. Re-authenticate the Codex CLI on this computer (run `codex login`) or reconnect it in Cloud settings, then retry.";
-    EPOCH_RESET = /\|\s*(\d{10})\b/;
-    WORDED_RESET = /\bresets?\s+(?:at\s+)?([^.\n]{1,60}?)\s*(?:$|[.\n])/i;
     COMMAND_NOT_FOUND = /\bcommand not found\b|\bno such file or directory\b/i;
     CODE_RULES = [
       { pattern: /model_not_found|model_not_available/, kind: "model_mismatch" },
@@ -24601,7 +24659,21 @@ var init_chunk_54ZRJOQP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-VMGVHPBB.js
+// ../agent-core/dist/chunk-4G77APXN.js
+function detectImageMimeType(buffer) {
+  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(PNG_SIGNATURE)) return "image/png";
+  if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) {
+    return "image/jpeg";
+  }
+  if (buffer.length >= 6) {
+    const signature = buffer.subarray(0, 6).toString("ascii");
+    if (signature === "GIF87a" || signature === "GIF89a") return "image/gif";
+  }
+  if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") {
+    return "image/webp";
+  }
+  return null;
+}
 function collectStrings(value, out) {
   if (typeof value === "string") out.push(value);
   else if (Array.isArray(value)) for (const item of value) collectStrings(item, out);
@@ -24970,12 +25042,12 @@ function silentStartError(name, timeoutMs) {
     message: `${name} printed nothing for ${seconds}s after it started and was stopped. Send your message again.`
   };
 }
-var import_crypto3, import_fs4, import_path3, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
-var init_chunk_VMGVHPBB = __esm({
-  "../agent-core/dist/chunk-VMGVHPBB.js"() {
+var import_crypto3, import_fs4, import_path3, PNG_SIGNATURE, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
+var init_chunk_4G77APXN = __esm({
+  "../agent-core/dist/chunk-4G77APXN.js"() {
     "use strict";
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_YXWJW7I5();
     import_crypto3 = require("crypto");
@@ -24983,6 +25055,7 @@ var init_chunk_VMGVHPBB = __esm({
     import_path3 = require("path");
     init_agent2();
     init_acp();
+    PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
     IMAGE_MIME_BY_EXT = {
       ".gif": "image/gif",
       ".jpeg": "image/jpeg",
@@ -25438,7 +25511,7 @@ var init_chunk_J2KTV5FP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-VX6QVMKD.js
+// ../agent-core/dist/chunk-FPGAN4XO.js
 function truncate(value, limit) {
   const normalized2 = Array.from(value, (character) => {
     const code = character.charCodeAt(0);
@@ -25701,7 +25774,7 @@ function cloudExecutionSection(spec) {
   );
   if (!isReadOnlyMode(spec.mode) && !isReadOnlyAgent(spec.agentId)) {
     lines.push(
-      "Own the authorized work end to end: inspect context, make reasonable assumptions, implement, test, review and create or update the pull request for code changes when the repository workflow calls for one. Do not stop at a plan or ask for routine implementation choices or permission already granted. Ask only for a missing secret, an essential decision you cannot derive, or an action requiring explicit approval. Respect the user's scope, repository rules and tool authorization; report a blocked capability and continue independent work."
+      "Own the authorized work end to end: inspect context, make reasonable assumptions, implement, test, review and create or update the pull request for code changes when the repository workflow calls for one. Do not stop at a plan or ask for routine implementation choices or permission already granted. For application changes, check the repository's setup instructions and configured start commands, start the app if needed, and verify it is reachable before testing. For user-facing flows, use alan-test-feature when installed to test the running app, capture a video, and create a test report. Ask only for a missing secret, an essential decision you cannot derive, or an action requiring explicit approval. Respect the user's scope, repository rules and tool authorization; report blocked capabilities and validation gaps while continuing independent work."
     );
   }
   const skills = spec.promptContext?.availableSkills ?? [];
@@ -25799,8 +25872,8 @@ ${body}` : body;
   return spec.mode === "plan" ? planModePrefix(prefixed) : prefixed;
 }
 var MAX_PARSED_ATTACHMENTS, MAX_PARSED_ATTACHMENT_CHARS, MAX_METADATA_CHARS, UNAVAILABLE, READ_ONLY_MODES, AGENT_MODES;
-var init_chunk_VX6QVMKD = __esm({
-  "../agent-core/dist/chunk-VX6QVMKD.js"() {
+var init_chunk_FPGAN4XO = __esm({
+  "../agent-core/dist/chunk-FPGAN4XO.js"() {
     "use strict";
     init_agent2();
     MAX_PARSED_ATTACHMENTS = 3;
@@ -26881,12 +26954,12 @@ var init_claude = __esm({
   "../agent-core/dist/providers/claude.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     init_effort();
     import_crypto6 = require("crypto");
@@ -28066,7 +28139,7 @@ function elicitationAnswer(elicitation, answer) {
   return { action: "accept", content };
 }
 function inferImageMimeType(buffer) {
-  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(PNG_SIGNATURE)) return "image/png";
+  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(PNG_SIGNATURE2)) return "image/png";
   if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) {
     return "image/jpeg";
   }
@@ -28185,6 +28258,29 @@ function imageKey(update) {
   const image = asRecord(update.image);
   return asString(image?.sourceHash) || asString(image?.id) || void 0;
 }
+function windowPatch(value) {
+  if (value === null) return null;
+  const record2 = asRecord(value);
+  if (!record2) return void 0;
+  const patch = {};
+  const usedPercent = asFiniteNumber(record2.usedPercent);
+  if (usedPercent !== void 0 && usedPercent >= 0 && usedPercent <= 100) {
+    patch.usedPercent = usedPercent;
+  } else if (record2.usedPercent === null) {
+    patch.usedPercent = null;
+  }
+  const duration3 = asFiniteNumber(record2.windowDurationMins);
+  if (duration3 !== void 0 && duration3 > 0) patch.windowMinutes = duration3;
+  else if (record2.windowDurationMins === null) patch.windowMinutes = null;
+  const seconds = asFiniteNumber(record2.resetsAt);
+  if (seconds !== void 0 && seconds >= 0) {
+    const reset = new Date(seconds * 1e3);
+    if (Number.isFinite(reset.getTime())) patch.resetsAt = reset.toISOString();
+  } else if (record2.resetsAt === null) {
+    patch.resetsAt = null;
+  }
+  return patch;
+}
 function isApprovalRequest(method) {
   return COMMAND_OR_FILE.has(method) || LEGACY.has(method);
 }
@@ -28596,7 +28692,10 @@ function classifyCodexError(error61) {
   const message = asString(error61?.message);
   const known = typeof info === "string" ? INFO_KINDS.get(info) : void 0;
   const own2 = normalizeCodexCliErrorMessage(message.trim());
-  if (known) return own2 ? { ...specForErrorKind(known), message: own2 } : specForErrorKind(known);
+  if (known) {
+    const classified = own2 ? { ...specForErrorKind(known), message: own2 } : specForErrorKind(known);
+    return known === "usage_limit" ? { ...classified, ...readCapReset(message) } : classified;
+  }
   const status = httpStatusOf(info);
   return classifyProviderError(message, status === void 0 ? {} : { status });
 }
@@ -28680,7 +28779,7 @@ async function handshake(session, spec, log) {
   }
   await session.rpc.notify("initialized");
 }
-async function preflight(session, spec) {
+async function preflight(session, spec, log) {
   if (spec.externalAuth) {
     const tokens2 = await spec.externalAuth.current();
     await session.rpc.request("account/login/start", {
@@ -28698,6 +28797,13 @@ async function preflight(session, spec) {
       specForErrorKind("not_logged_in")
     );
   }
+  if (spec.externalAuth) {
+    try {
+      session.observeRateLimits(await session.rpc.request("account/rateLimits/read", {}));
+    } catch {
+      log.warn("codex.rate_limits_unavailable", {});
+    }
+  }
 }
 function threadOf(result) {
   const thread = asRecord(asRecord(result)?.thread);
@@ -28759,7 +28865,7 @@ function createCodexDriver(options = {}) {
       try {
         const opening = (async () => {
           await handshake(session, spec, resolved.log);
-          await preflight(session, spec);
+          await preflight(session, spec, resolved.log);
           return openThread(session, spec, resolved.log);
         })();
         const thread = await withDeadline(
@@ -28910,7 +29016,7 @@ function createCodexExecDriver(options = {}) {
   };
 }
 function envDigest2(env) {
-  const hash2 = (0, import_crypto9.createHash)("sha256");
+  const hash2 = (0, import_crypto10.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -28951,7 +29057,7 @@ function planCodexExecSession(run, context) {
   };
 }
 function envDigest22(env) {
-  const hash2 = (0, import_crypto10.createHash)("sha256");
+  const hash2 = (0, import_crypto11.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -29020,26 +29126,28 @@ function codexTurnInput(run, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession;
+var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, import_crypto11, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE2, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, CodexRateLimits, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession;
 var init_codex = __esm({
   "../agent-core/dist/providers/codex.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_fs6 = require("fs");
     import_path6 = require("path");
     init_effort();
     import_crypto8 = require("crypto");
-    init_agent2();
     import_crypto9 = require("crypto");
+    init_runtime_v2();
     init_agent2();
     import_crypto10 = require("crypto");
+    init_agent2();
+    import_crypto11 = require("crypto");
     init_effort();
     TokenRefresher = class {
       #auth;
@@ -29080,7 +29188,7 @@ var init_codex = __esm({
     ];
     ACCEPT_DECLINE = [{ label: "Accept" }, { label: "Decline" }];
     MAX_INLINE_GENERATED_IMAGE_BYTES = 20 * 1024 * 1024;
-    PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+    PNG_SIGNATURE2 = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
     JPEG_NON_FRAME_MARKERS = /* @__PURE__ */ new Set([196, 200, 204]);
     IMAGE_GEN_CALL = /\bimage_gen\w*\s*\(/;
     PROMPT_LITERAL = /\bprompt\s*:\s*("(?:[^"\\]|\\.)*")/;
@@ -29223,6 +29331,46 @@ var init_codex = __esm({
         return this.#cursor;
       }
     };
+    CodexRateLimits = class {
+      #clock;
+      #sourceId;
+      #sequence = 0;
+      constructor(clock, sourceId = (0, import_crypto9.randomUUID)()) {
+        this.#clock = clock;
+        this.#sourceId = sourceId;
+      }
+      read(value) {
+        const response = asRecord(value);
+        const buckets = asRecord(response?.rateLimitsByLimitId);
+        if (buckets) {
+          return Object.entries(buckets).flatMap(
+            ([limitId, snapshot2]) => this.#update(snapshot2, limitId)
+          );
+        }
+        return this.#update(response?.rateLimits);
+      }
+      notification(params) {
+        return this.#update(params.rateLimits);
+      }
+      #update(value, bucketId) {
+        const snapshot2 = asRecord(value);
+        if (!snapshot2) return [];
+        const primary = windowPatch(snapshot2.primary);
+        const secondary = windowPatch(snapshot2.secondary);
+        const planType = snapshot2.planType === null ? null : asString(snapshot2.planType) || void 0;
+        const parsed = runCodexRateLimitsUpdateSchema.safeParse({
+          sessionUpdate: "_alan/codex.rate_limits",
+          limitId: bucketId ?? (asString(snapshot2.limitId) || "codex"),
+          ...primary === void 0 ? {} : { primary },
+          ...secondary === void 0 ? {} : { secondary },
+          ...planType === void 0 ? {} : { planType },
+          observedAt: new Date(this.#clock.now()).toISOString(),
+          sourceId: this.#sourceId,
+          sequence: this.#sequence++
+        });
+        return parsed.success ? [parsed.data] : [];
+      }
+    };
     USER_INPUT_METHOD = "item/tool/requestUserInput";
     PERMISSIONS_METHOD = "item/permissions/requestApproval";
     ELICITATION_METHOD = "mcpServer/elicitation/request";
@@ -29292,7 +29440,6 @@ var init_codex = __esm({
       "thread/closed",
       "hook/started",
       "hook/completed",
-      "account/rateLimits/updated",
       "account/updated",
       "account/login/completed",
       "remoteControl/status/changed",
@@ -29487,6 +29634,7 @@ var init_codex = __esm({
       #listeners = createListeners();
       #options;
       #memory;
+      #rateLimits;
       #stderr = [];
       #approvals = /* @__PURE__ */ new Map();
       /** Session-level updates (thread start warnings, MCP startup) that open the next turn's log. */
@@ -29503,6 +29651,7 @@ var init_codex = __esm({
       constructor(child, tree, memory, options) {
         this.#options = options;
         this.#memory = memory;
+        this.#rateLimits = new CodexRateLimits(options.clock);
         this.#lastTurn = new CodexTurn(memory, options.clock);
         this.#host = hostProcess(
           child,
@@ -29537,6 +29686,9 @@ var init_codex = __esm({
       configure(config2) {
         this.#config = config2;
       }
+      observeRateLimits(response) {
+        this.#recordRateLimits(this.#rateLimits.read(response));
+      }
       attachThread(threadId, rolloutPath) {
         if (threadId === this.#threadId) return;
         this.#threadId = threadId;
@@ -29703,6 +29855,10 @@ var init_codex = __esm({
         return known === void 0 || known === turnId ? active : void 0;
       }
       #onNotification(notification) {
+        if (notification.method === "account/rateLimits/updated") {
+          this.#recordRateLimits(this.#rateLimits.notification(notification.params));
+          return;
+        }
         if (notification.method === "serverRequest/resolved") this.#dropResolved(notification);
         const active = this.#ownerOf(notification);
         const reader = active?.turn ?? this.#lastTurn;
@@ -29729,6 +29885,14 @@ var init_codex = __esm({
           void this.#stopTurn(active);
         }
       }
+      #recordRateLimits(updates) {
+        const active = this.#current;
+        if (active) this.#emitUpdates(active, updates);
+        else {
+          this.#between.push(...updates);
+          this.#between.splice(0, Math.max(0, this.#between.length - MAX_BETWEEN_UPDATES));
+        }
+      }
       #emitUpdates(active, updates) {
         for (const update of updates) this.#emit({ type: "update", turnId: active.id, update });
       }
@@ -30382,9 +30546,9 @@ function alanCodeEngineEnv(input2) {
   };
 }
 async function writePlugin(directory, apiOrigin) {
-  const origin = (0, import_crypto11.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
+  const origin = (0, import_crypto12.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
   const target = (0, import_path8.join)(directory, `engine-plugin-v${ALAN_CODE_ENGINE_PLUGIN_VERSION}-${origin}.mjs`);
-  const temporary = `${target}.${(0, import_crypto11.randomUUID)()}.tmp`;
+  const temporary = `${target}.${(0, import_crypto12.randomUUID)()}.tmp`;
   await (0, import_promises15.mkdir)(directory, { recursive: true, mode: 448 });
   await (0, import_promises15.writeFile)(temporary, alanCodeEnginePluginSource(apiOrigin), { mode: 384 });
   await (0, import_promises15.rename)(temporary, target);
@@ -30416,7 +30580,7 @@ function alanCodeSystemPrompt(alanSystemPrompt) {
 
 ${instructions}` : ALAN_CODE_TOOL_NAMING_PROMPT;
 }
-var import_http3, import_https, import_fs7, import_path7, import_crypto11, import_promises15, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ACTIVATION_WAIT_MS, ACTIVATION_POLL_MS, CatalogResponseError, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
+var import_http3, import_https, import_fs7, import_path7, import_crypto12, import_promises15, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ACTIVATION_WAIT_MS, ACTIVATION_POLL_MS, CatalogResponseError, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
 var init_alan_code = __esm({
   "../agent-core/dist/providers/alan-code.js"() {
     "use strict";
@@ -30429,7 +30593,7 @@ var init_alan_code = __esm({
     import_fs7 = require("fs");
     import_path7 = require("path");
     init_runtime_v2();
-    import_crypto11 = require("crypto");
+    import_crypto12 = require("crypto");
     import_promises15 = require("fs/promises");
     import_path8 = require("path");
     import_url = require("url");
@@ -37799,9 +37963,9 @@ var require_dist = __commonJS({
 var init_dist = __esm({
   "../agent-core/dist/index.js"() {
     "use strict";
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_YXWJW7I5();
   }
@@ -38475,7 +38639,7 @@ function isAcpBackendKind(value) {
   return Object.hasOwn(ACP_PROFILES, value);
 }
 function envDigest3(env) {
-  const hash2 = (0, import_crypto12.createHash)("sha256");
+  const hash2 = (0, import_crypto13.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -38542,22 +38706,22 @@ async function acpTurnInput(run, context) {
     ...encoded.length ? { images: encoded, imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_promises23, import_path9, import_crypto12, import_promises24, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
+var import_promises23, import_path9, import_crypto13, import_promises24, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
 var init_acp3 = __esm({
   "../agent-core/dist/providers/acp.js"() {
     "use strict";
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_promises23 = require("fs/promises");
     import_path9 = require("path");
     init_effort();
     init_acp();
-    import_crypto12 = require("crypto");
+    import_crypto13 = require("crypto");
     import_promises24 = require("fs/promises");
     init_agent2();
     CURSOR_ASK_QUESTION = "cursor/ask_question";
@@ -39363,7 +39527,7 @@ var init_acp3 = __esm({
 var init_classify = __esm({
   "../agent-core/dist/classify.js"() {
     "use strict";
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_YXWJW7I5();
   }
 });
@@ -39573,7 +39737,10 @@ function createPersistentDriver(provider4, options) {
     return "delivered";
   };
   const openFailed = (error61, spec, sink, signal, inputs) => {
-    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && options.fallback) {
+    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && inputs.codex !== void 0) {
+      return { outcome: "failed", message: error61.message };
+    }
+    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && options.fallback && inputs.codex === void 0) {
       log.warn("holder.persistent_unsupported", {
         harness: provider4.harness,
         message: error61.message
@@ -39590,7 +39757,7 @@ function createPersistentDriver(provider4, options) {
   };
   return {
     runTurn: async (spec, sink, signal, inputs) => {
-      if (live.fallbackOnly && options.fallback)
+      if (live.fallbackOnly && options.fallback && inputs.codex === void 0)
         return options.fallback.runTurn(spec, sink, signal, inputs);
       if (signal.aborted) return { outcome: "aborted" };
       const managedMcp = await managedMcpAccess(signal);
@@ -40180,7 +40347,7 @@ function createOpenCodeDriver(options = {}) {
         await authorization?.remove();
       };
       const spec = { ...planned, env: launchEnv(planned, authorization) };
-      const password = options.password?.() ?? (0, import_crypto13.randomBytes)(24).toString("base64url");
+      const password = options.password?.() ?? (0, import_crypto14.randomBytes)(24).toString("base64url");
       try {
         const session = await openWithRetries(spec, password, resolved);
         void session.exited.then(removeAuthorization).catch((error61) => {
@@ -40195,7 +40362,7 @@ function createOpenCodeDriver(options = {}) {
   };
 }
 function envDigest4(env) {
-  const hash2 = (0, import_crypto14.createHash)("sha256");
+  const hash2 = (0, import_crypto15.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -40276,20 +40443,20 @@ function openCodeTurnInput(run, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_http4, import_crypto13, import_promises25, import_path10, import_path11, import_url2, import_crypto14, IDLE_SOCKET_MS2, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
+var import_http4, import_crypto14, import_promises25, import_path10, import_path11, import_url2, import_crypto15, IDLE_SOCKET_MS2, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
 var init_opencode = __esm({
   "../agent-core/dist/providers/opencode.js"() {
     "use strict";
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_http4 = require("http");
     init_runtime_v2();
-    import_crypto13 = require("crypto");
+    import_crypto14 = require("crypto");
     import_promises25 = require("fs/promises");
     import_path10 = require("path");
     init_agent2();
@@ -40297,7 +40464,7 @@ var init_opencode = __esm({
     import_url2 = require("url");
     init_acp();
     init_acp();
-    import_crypto14 = require("crypto");
+    import_crypto15 = require("crypto");
     init_agent2();
     IDLE_SOCKET_MS2 = 4e3;
     OpenCodeHttpError = class extends Error {
@@ -41593,11 +41760,11 @@ function createCodexLogin(broker) {
     }
   };
 }
-function withLogin(planned, externalAuth, accountId) {
+function withLogin(planned, externalAuth, credentialKey) {
   return {
     ...planned,
     spec: { ...planned.spec, externalAuth },
-    key: JSON.stringify([planned.key, accountId])
+    key: JSON.stringify([planned.key, credentialKey])
   };
 }
 function createCodexHolderDriver(options) {
@@ -41619,7 +41786,11 @@ function createCodexHolderDriver(options) {
         });
         if (inputs.codex === void 0) return planned;
         login.forTurn(spec.runId, inputs.codex);
-        return withLogin(planned, login.externalAuth, inputs.codex.chatgptAccountId);
+        return withLogin(
+          planned,
+          login.externalAuth,
+          inputs.codex.credentialId ?? inputs.codex.chatgptAccountId
+        );
       },
       canResume: () => true,
       open: async (spec) => {
@@ -42032,7 +42203,7 @@ function createDroidDriver(options = {}) {
   };
 }
 function envDigest5(env) {
-  const hash2 = (0, import_crypto15.createHash)("sha256");
+  const hash2 = (0, import_crypto16.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -42092,19 +42263,19 @@ async function droidTurnInput(run, context) {
   );
   return { turnId: run.runId, text: text2, ...encoded.length ? { images: encoded } : {} };
 }
-var import_crypto15, import_promises26, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
+var import_crypto16, import_promises26, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
 var init_droid = __esm({
   "../agent-core/dist/providers/droid.js"() {
     "use strict";
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     init_runtime_v2();
-    import_crypto15 = require("crypto");
+    import_crypto16 = require("crypto");
     import_promises26 = require("fs/promises");
     init_agent2();
     FACTORY_API_VERSION = "1.0.0";
@@ -43152,7 +43323,7 @@ ${output2.stderr}`).join("\n")
   };
 }
 function envDigest6(env) {
-  const hash2 = (0, import_crypto16.createHash)("sha256");
+  const hash2 = (0, import_crypto17.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -43198,16 +43369,16 @@ function antigravityTurnInput(run, context) {
   });
   return { turnId: run.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises27, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
+var import_promises27, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto17, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
 var init_antigravity = __esm({
   "../agent-core/dist/providers/antigravity.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_promises27 = require("fs/promises");
     import_path12 = require("path");
@@ -43217,7 +43388,7 @@ var init_antigravity = __esm({
     init_effort();
     import_path14 = require("path");
     import_url3 = require("url");
-    import_crypto16 = require("crypto");
+    import_crypto17 = require("crypto");
     init_agent2();
     NO_ANTIGRAVITY_CAPABILITIES = {
       structuredPrint: false,
@@ -43851,7 +44022,7 @@ function createCommandCodeDriver(options = {}) {
   };
 }
 function envDigest7(env) {
-  const hash2 = (0, import_crypto17.createHash)("sha256");
+  const hash2 = (0, import_crypto18.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -43903,23 +44074,23 @@ function commandCodeTurnInput(run, context) {
   });
   return { turnId: run.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises28, import_path15, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
+var import_promises28, import_path15, import_crypto18, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
 var init_command_code = __esm({
   "../agent-core/dist/providers/command-code.js"() {
     "use strict";
-    init_chunk_VMGVHPBB();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_VX6QVMKD();
+    init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_promises28 = require("fs/promises");
     import_path15 = require("path");
     init_agent2();
     init_runtime_v2();
     init_acp();
-    import_crypto17 = require("crypto");
+    import_crypto18 = require("crypto");
     init_agent2();
     COMMAND_CODE_GRAMMAR_NAME = "command_code_cli";
     SILENT3 = /* @__PURE__ */ new Set([
@@ -44910,7 +45081,18 @@ function createHttpTransport() {
 
 // src/api-client/holder-client.ts
 init_runtime_v2();
+init_zod();
 var REQUEST_TIMEOUT_MS = 3e4;
+var credentialRefusalSchema = external_exports.object({ message: external_exports.string().trim().min(1) });
+function credentialFailureMessage(response, fallback) {
+  if (response.status !== 409) return fallback;
+  try {
+    const parsed = credentialRefusalSchema.safeParse(jsonBody(response));
+    return parsed.success ? parsed.data.message : fallback;
+  } catch {
+    return fallback;
+  }
+}
 function createHolderApiClient({
   apiUrl,
   accessToken,
@@ -44943,7 +45125,10 @@ function createHolderApiClient({
       if (!isOk(response)) {
         throw new RuntimeFault(
           "io_failed",
-          `Provider credential request failed: ${response.status}`
+          credentialFailureMessage(
+            response,
+            `Provider credential request failed: ${response.status}`
+          )
         );
       }
       return runProviderCredentialSchema.parse(jsonBody(response));
@@ -44951,7 +45136,10 @@ function createHolderApiClient({
     refreshCodexCredential: async (runId, body, signal) => {
       const response = await request2("POST", runCodexCredentialRefreshPath(runId), signal, body);
       if (!isOk(response)) {
-        throw new RuntimeFault("io_failed", `Codex sign-in refresh failed: ${response.status}`);
+        throw new RuntimeFault(
+          "io_failed",
+          credentialFailureMessage(response, `Codex sign-in refresh failed: ${response.status}`)
+        );
       }
       return runCodexCredentialSchema.parse(jsonBody(response));
     },
@@ -46914,6 +47102,7 @@ function createHelperMcpAccess(options) {
 // src/holder/run-inputs.ts
 var import_promises30 = require("fs/promises");
 var import_node_path18 = require("path");
+init_dist();
 var NO_RUN_INPUTS = {
   attachments: [],
   providerEnv: {},
@@ -46938,11 +47127,12 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
       const bytes = await source.downloadAttachment(spec.runId, attachment.id, signal);
       const path = (0, import_node_path18.join)(dir, `${index}-${safeFilename(attachment.filename)}`);
       await (0, import_promises30.writeFile)(path, bytes, { mode: 384 });
+      const imageMimeType = attachment.kind === "image" ? detectImageMimeType(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)) : null;
       attachments.push({
         id: attachment.id,
         kind: attachment.kind,
         filename: attachment.filename,
-        mimeType: attachment.mimeType,
+        mimeType: imageMimeType ?? attachment.mimeType,
         size: bytes.byteLength,
         path,
         ...attachment.label === void 0 ? {} : { label: attachment.label },