@buildautomaton/cli 0.1.78 → 0.1.80

package/dist/cli.js

@@ -7262,31 +7262,31 @@ function handleWorkerOutMessage(message) {
     return;
   }
   if (message.type === "error") {
-    const pending2 = message.requestId != null ? pendingRequests.get(message.requestId) : void 0;
+    const pending3 = message.requestId != null ? pendingRequests.get(message.requestId) : void 0;
     maybeLogCodeNavCacheWorkerError(message.message);
-    if (pending2 != null) {
+    if (pending3 != null) {
       pendingRequests.delete(message.requestId);
       if (isCliImmediateShutdownRequested()) {
-        pending2.reject(new CliSqliteInterrupted());
+        pending3.reject(new CliSqliteInterrupted());
       } else {
-        pending2.reject(new Error(message.message));
+        pending3.reject(new Error(message.message));
       }
     }
     return;
   }
   if (!("requestId" in message)) return;
-  const pending = pendingRequests.get(message.requestId);
-  if (pending == null) return;
+  const pending2 = pendingRequests.get(message.requestId);
+  if (pending2 == null) return;
   pendingRequests.delete(message.requestId);
-  pending.resolve(message);
+  pending2.resolve(message);
 }
 function resetWorkerReadyState() {
   workerReady = false;
   workerReadyWaiters = [];
 }
 function rejectAllPendingRequests(error40) {
-  for (const [, pending] of pendingRequests) {
-    pending.reject(error40);
+  for (const [, pending2] of pendingRequests) {
+    pending2.reject(error40);
   }
   pendingRequests.clear();
 }
@@ -8319,14 +8319,14 @@ function legacyCliDiskMigrationIsPending() {
   return false;
 }
 function importCliSqliteLegacyDiskData(db, log2) {
-  const pending = legacyCliDiskMigrationIsPending();
-  if (pending && log2) {
+  const pending2 = legacyCliDiskMigrationIsPending();
+  if (pending2 && log2) {
     log2("Migrating legacy on-disk CLI data to SQLite\u2026");
   }
   archiveLegacyFileIndexJsonFiles();
   importLegacyAgentSessionsFromDisk(db);
   importLegacyPromptQueuesFromDisk(db);
-  if (pending && log2) {
+  if (pending2 && log2) {
     log2("Legacy on-disk CLI data migration finished.");
   }
 }
@@ -12522,6 +12522,16 @@ async function awaitSymbolIndexWorkerShutdown() {
     await terminateSymbolIndexWorker2();
   }
 }
+async function clearCliImmediateShutdown() {
+  if (symbolIndexShutdownPromise != null) {
+    try {
+      await symbolIndexShutdownPromise;
+    } catch {
+    }
+  }
+  cliImmediateShutdownRequested = false;
+  symbolIndexShutdownPromise = null;
+}
 function resetCliImmediateShutdownForTests() {
   cliImmediateShutdownRequested = false;
   symbolIndexShutdownPromise = null;
@@ -16657,7 +16667,7 @@ var require_tree_kill = __commonJS({
   "../../node_modules/.pnpm/tree-kill@1.2.2/node_modules/tree-kill/index.js"(exports, module) {
     "use strict";
     var childProcess2 = __require("child_process");
-    var spawn11 = childProcess2.spawn;
+    var spawn12 = childProcess2.spawn;
     var exec = childProcess2.exec;
     module.exports = function(pid, signal, callback) {
       if (typeof signal === "function" && callback === void 0) {
@@ -16682,7 +16692,7 @@ var require_tree_kill = __commonJS({
           break;
         case "darwin":
           buildProcessTree(pid, tree, pidsToProcess, function(parentPid) {
-            return spawn11("pgrep", ["-P", parentPid]);
+            return spawn12("pgrep", ["-P", parentPid]);
           }, function() {
             killAll(tree, signal, callback);
           });
@@ -16694,7 +16704,7 @@ var require_tree_kill = __commonJS({
         //     break;
         default:
           buildProcessTree(pid, tree, pidsToProcess, function(parentPid) {
-            return spawn11("ps", ["-o", "pid", "--no-headers", "--ppid", parentPid]);
+            return spawn12("ps", ["-o", "pid", "--no-headers", "--ppid", parentPid]);
           }, function() {
             killAll(tree, signal, callback);
           });
@@ -31071,7 +31081,7 @@ var {
 } = import_index.default;
 
 // src/cli-version.ts
-var CLI_VERSION = "0.1.78".length > 0 ? "0.1.78" : "0.0.0-dev";
+var CLI_VERSION = "0.1.80".length > 0 ? "0.1.80" : "0.0.0-dev";
 
 // src/cli/defaults.ts
 var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
@@ -31533,181 +31543,8 @@ function installBridgeProcessResilience() {
   });
 }
 
-// ../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/wrapper.mjs
-var import_stream = __toESM(require_stream(), 1);
-var import_receiver = __toESM(require_receiver(), 1);
-var import_sender = __toESM(require_sender(), 1);
-var import_websocket = __toESM(require_websocket(), 1);
-var import_websocket_server = __toESM(require_websocket_server(), 1);
-var wrapper_default = import_websocket.default;
-
-// src/connection/cli-ws-client.ts
-import https from "node:https";
-var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
-function attachWebSocketClientPing(ws, intervalMs) {
-  let timer = null;
-  function clear() {
-    if (timer != null) {
-      clearInterval(timer);
-      timer = null;
-    }
-  }
-  clear();
-  timer = setInterval(() => {
-    if (ws.readyState === wrapper_default.OPEN) {
-      try {
-        ws.ping();
-      } catch {
-      }
-    }
-  }, intervalMs);
-  return clear;
-}
-function buildCliWebSocketClientOptions(wsUrl) {
-  const wsOptions = { perMessageDeflate: false };
-  if (wsUrl.startsWith("wss://")) {
-    wsOptions.agent = new https.Agent({ rejectUnauthorized: false });
-  }
-  return wsOptions;
-}
-function logCliWebSocketError(log2, serviceLabel, err, detail) {
-  const mid = detail ? ` ${detail}` : "";
-  log2(`${serviceLabel} WebSocket error${mid}: ${err.message}`);
-}
-function safeCloseWebSocket(ws) {
-  try {
-    if (ws.readyState === wrapper_default.CLOSED) {
-      ws.removeAllListeners();
-      return;
-    }
-    ws.once("close", () => {
-      ws.removeAllListeners();
-    });
-    ws.close();
-  } catch {
-    try {
-      ws.removeAllListeners();
-    } catch {
-    }
-  }
-}
-function safeSendWebSocketBinary(ws, data) {
-  if (ws.readyState !== wrapper_default.OPEN) return false;
-  try {
-    ws.send(data, { binary: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/connection/parse-compact-heartbeat-ack.ts
-function tryParseCompactHeartbeatAck(raw) {
-  let str = null;
-  if (typeof raw === "string") {
-    str = raw;
-  } else if (Buffer.isBuffer(raw)) {
-    str = raw.toString("utf8");
-  } else if (raw instanceof ArrayBuffer) {
-    str = Buffer.from(raw).toString("utf8");
-  } else {
-    return null;
-  }
-  if (str.length > 64 || !str.includes('"ha"')) return null;
-  try {
-    const parsed = JSON.parse(str);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const o = parsed;
-    if (o.t !== "ha") return null;
-    const s = o.s;
-    if (typeof s !== "number" || !Number.isFinite(s)) return null;
-    return Math.trunc(s);
-  } catch {
-    return null;
-  }
-}
-
-// src/connection/create-ws-bridge.ts
-var BRIDGE_AUTH_ERROR_HEADER = "x-bridge-auth-error";
-var BRIDGE_AUTH_ERROR_TOKEN_INVALID = "token_invalid";
-function createWsBridge(options) {
-  const {
-    url: url2,
-    onMessage,
-    onOpen,
-    onClose,
-    onError: onError2,
-    onAuthInvalid,
-    clientPingIntervalMs,
-    onCompactHeartbeatAck,
-    isActiveSocket
-  } = options;
-  const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
-  let clearClientPing = null;
-  function disposeClientPing() {
-    clearClientPing?.();
-    clearClientPing = null;
-  }
-  ws.on("unexpected-response", (request, response) => {
-    const status = response?.statusCode ?? 0;
-    const headers = response?.headers ?? {};
-    const errCode = (headers[BRIDGE_AUTH_ERROR_HEADER] ?? headers["X-Bridge-Auth-Error"] ?? "").toLowerCase();
-    if (status === 401 && errCode === BRIDGE_AUTH_ERROR_TOKEN_INVALID) {
-      void Promise.resolve(onAuthInvalid?.());
-    }
-  });
-  ws.on("open", () => {
-    disposeClientPing();
-    if (clientPingIntervalMs != null && clientPingIntervalMs > 0) {
-      clearClientPing = attachWebSocketClientPing(ws, clientPingIntervalMs);
-    }
-    onOpen?.();
-  });
-  ws.on("message", (raw) => {
-    const ackSeq = tryParseCompactHeartbeatAck(raw);
-    if (ackSeq != null) {
-      onCompactHeartbeatAck?.(ackSeq);
-      return;
-    }
-    setImmediate(() => {
-      if (isActiveSocket && !isActiveSocket(ws)) return;
-      try {
-        let data;
-        if (typeof raw === "string") {
-          data = JSON.parse(raw);
-        } else if (Buffer.isBuffer(raw) || raw instanceof ArrayBuffer) {
-          const str = Buffer.isBuffer(raw) ? raw.toString("utf8") : Buffer.from(raw).toString("utf8");
-          data = JSON.parse(str);
-        } else {
-          data = raw;
-        }
-        onMessage?.(data, ws);
-      } catch {
-        onMessage?.(raw, ws);
-      }
-    });
-  });
-  ws.on("close", (code, reason) => {
-    disposeClientPing();
-    onClose?.(code, reason.toString());
-  });
-  ws.on("error", (err) => {
-    disposeClientPing();
-    onError2?.(err);
-  });
-  return ws;
-}
-function sendWsMessage(ws, payload) {
-  if (ws.readyState === wrapper_default.OPEN) {
-    ws.send(JSON.stringify(payload));
-  }
-}
-
-// src/connection/heartbeat/constants.ts
-var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
-var BRIDGE_HEARTBEAT_SEQ_MAX = 2147483646;
-var BRIDGE_HEARTBEAT_MISSED_ACKS_BEFORE_RECONNECT = 4;
-var BRIDGE_HEARTBEAT_RTT_SAMPLE_MAX = 5;
+// src/auth/pending/run-pending-auth.ts
+init_log();
 
 // ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
 import process7 from "node:process";
@@ -32262,8 +32099,196 @@ async function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName
   }
 }
 
-// src/auth/run-pending-auth.ts
-init_log();
+// src/auth/pending/constants.ts
+var PENDING_KEEPALIVE_MS = 25e3;
+var BROWSER_OPEN_FALLBACK_MS = 4e3;
+
+// ../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/wrapper.mjs
+var import_stream = __toESM(require_stream(), 1);
+var import_receiver = __toESM(require_receiver(), 1);
+var import_sender = __toESM(require_sender(), 1);
+var import_websocket = __toESM(require_websocket(), 1);
+var import_websocket_server = __toESM(require_websocket_server(), 1);
+var wrapper_default = import_websocket.default;
+
+// src/connection/cli-ws-client.ts
+import https from "node:https";
+var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
+function attachWebSocketClientPing(ws, intervalMs) {
+  let timer = null;
+  function clear() {
+    if (timer != null) {
+      clearInterval(timer);
+      timer = null;
+    }
+  }
+  clear();
+  timer = setInterval(() => {
+    if (ws.readyState === wrapper_default.OPEN) {
+      try {
+        ws.ping();
+      } catch {
+      }
+    }
+  }, intervalMs);
+  return clear;
+}
+function buildCliWebSocketClientOptions(wsUrl) {
+  const wsOptions = { perMessageDeflate: false };
+  if (wsUrl.startsWith("wss://")) {
+    wsOptions.agent = new https.Agent({ rejectUnauthorized: false });
+  }
+  return wsOptions;
+}
+function logCliWebSocketError(log2, serviceLabel, err, detail) {
+  const mid = detail ? ` ${detail}` : "";
+  log2(`${serviceLabel} WebSocket error${mid}: ${err.message}`);
+}
+function safeCloseWebSocket(ws) {
+  try {
+    if (ws.readyState === wrapper_default.CLOSED) {
+      ws.removeAllListeners();
+      return;
+    }
+    ws.once("close", () => {
+      ws.removeAllListeners();
+    });
+    ws.close();
+  } catch {
+    try {
+      ws.removeAllListeners();
+    } catch {
+    }
+  }
+}
+function safeSendWebSocketBinary(ws, data) {
+  if (ws.readyState !== wrapper_default.OPEN) return false;
+  try {
+    ws.send(data, { binary: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/connection/create-ws-bridge-options.ts
+var BRIDGE_AUTH_ERROR_HEADER = "x-bridge-auth-error";
+var BRIDGE_AUTH_ERROR_TOKEN_INVALID = "token_invalid";
+
+// src/connection/dispatch-ws-inbound-message.ts
+function dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket) {
+  if (isActiveSocket && !isActiveSocket(ws)) return;
+  try {
+    let data;
+    if (typeof raw === "string") {
+      data = JSON.parse(raw);
+    } else if (Buffer.isBuffer(raw) || raw instanceof ArrayBuffer) {
+      const str = Buffer.isBuffer(raw) ? raw.toString("utf8") : Buffer.from(raw).toString("utf8");
+      data = JSON.parse(str);
+    } else {
+      data = raw;
+    }
+    onMessage?.(data, ws);
+  } catch {
+    onMessage?.(raw, ws);
+  }
+}
+
+// src/connection/parse-compact-heartbeat-ack.ts
+function tryParseCompactHeartbeatAck(raw) {
+  let str = null;
+  if (typeof raw === "string") {
+    str = raw;
+  } else if (Buffer.isBuffer(raw)) {
+    str = raw.toString("utf8");
+  } else if (raw instanceof ArrayBuffer) {
+    str = Buffer.from(raw).toString("utf8");
+  } else {
+    return null;
+  }
+  if (str.length > 64 || !str.includes('"ha"')) return null;
+  try {
+    const parsed = JSON.parse(str);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const o = parsed;
+    if (o.t !== "ha") return null;
+    const s = o.s;
+    if (typeof s !== "number" || !Number.isFinite(s)) return null;
+    return Math.trunc(s);
+  } catch {
+    return null;
+  }
+}
+
+// src/connection/create-ws-bridge.ts
+function createWsBridge(options) {
+  const {
+    url: url2,
+    onMessage,
+    onOpen,
+    onClose,
+    onError: onError2,
+    onAuthInvalid,
+    clientPingIntervalMs,
+    onCompactHeartbeatAck,
+    isActiveSocket,
+    deferInboundMessages = true
+  } = options;
+  const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
+  let clearClientPing = null;
+  const disposeClientPing = () => {
+    clearClientPing?.();
+    clearClientPing = null;
+  };
+  ws.on("unexpected-response", (_request, response) => {
+    const status = response?.statusCode ?? 0;
+    const headers = response?.headers ?? {};
+    const errCode = (headers[BRIDGE_AUTH_ERROR_HEADER] ?? headers["X-Bridge-Auth-Error"] ?? "").toLowerCase();
+    if (status === 401 && errCode === BRIDGE_AUTH_ERROR_TOKEN_INVALID) {
+      void Promise.resolve(onAuthInvalid?.());
+    }
+  });
+  ws.on("open", () => {
+    disposeClientPing();
+    if (clientPingIntervalMs != null && clientPingIntervalMs > 0) {
+      clearClientPing = attachWebSocketClientPing(ws, clientPingIntervalMs);
+    }
+    onOpen?.();
+  });
+  ws.on("message", (raw) => {
+    const ackSeq = tryParseCompactHeartbeatAck(raw);
+    if (ackSeq != null) {
+      onCompactHeartbeatAck?.(ackSeq);
+      return;
+    }
+    if (deferInboundMessages) {
+      setImmediate(() => dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket));
+      return;
+    }
+    dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket);
+  });
+  ws.on("close", (code, reason) => {
+    disposeClientPing();
+    onClose?.(code, reason.toString());
+  });
+  ws.on("error", (err) => {
+    disposeClientPing();
+    onError2?.(err);
+  });
+  return ws;
+}
+function sendWsMessage(ws, payload) {
+  if (ws.readyState !== wrapper_default.OPEN) return false;
+  ws.send(JSON.stringify(payload));
+  return true;
+}
+
+// src/auth/pending/build-pending-bridge-url.ts
+function buildPendingBridgeUrl(apiUrl, connectionId) {
+  const base = apiUrl.startsWith("https") ? apiUrl.replace(/^https/, "wss") : apiUrl.replace(/^http/, "ws");
+  const params = new URLSearchParams({ connectionId });
+  return `${base}/ws/bridge/pending?${params.toString()}`;
+}
 
 // src/connection/reconnect/constants.ts
 var RECONNECT_QUIET_MS = 2e3;
@@ -32594,6 +32619,12 @@ function scheduleMainBridgeReconnect(state, connect, log2, closeMeta) {
   });
 }
 
+// src/connection/heartbeat/constants.ts
+var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
+var BRIDGE_HEARTBEAT_SEQ_MAX = 2147483646;
+var BRIDGE_HEARTBEAT_MISSED_ACKS_BEFORE_RECONNECT = 4;
+var BRIDGE_HEARTBEAT_RTT_SAMPLE_MAX = 5;
+
 // src/connection/reconnect/duplicate-bridge-connection-detect.ts
 var BRIDGE_SUPERSEDED_CLOSE_REASON_SNIPPET = "superseded";
 var DUPLICATE_BRIDGE_SHORT_SESSION_MS = 25e3;
@@ -32678,145 +32709,177 @@ function clearFirehoseReconnectQuietOnOpen(ctx, log2) {
   });
 }
 
-// src/auth/run-pending-auth.ts
-var PENDING_KEEPALIVE_MS = 25e3;
-var BROWSER_OPEN_FALLBACK_MS = 4e3;
-function buildPendingBridgeUrl(apiUrl, connectionId) {
-  const base = apiUrl.startsWith("https") ? apiUrl.replace(/^https/, "wss") : apiUrl.replace(/^http/, "ws");
-  const params = new URLSearchParams({ connectionId });
-  return `${base}/ws/bridge/pending?${params.toString()}`;
-}
-function runPendingAuth(options) {
-  const { apiUrl, initialWorkspaceId, preferredBridgeName, onAuth } = options;
-  const logFn = options.log ?? log;
-  let ws = null;
-  let reconnectTimeout = null;
-  let keepaliveInterval = null;
-  let browserFallback = null;
-  const connectionId = crypto.randomUUID();
-  let hasOpenedBrowser = false;
-  let resolved = false;
-  let resolveAuth;
-  const authPromise = new Promise((resolve37) => {
-    resolveAuth = resolve37;
-  });
-  let reconnectAttempt = 0;
-  const signInQuiet = createEmptyReconnectQuietSlot();
-  function clearQuietOnOpen() {
-    clearReconnectQuietOnSuccessfulConnection(
-      signInQuiet,
-      logFn,
-      "[Bridge service] Sign-in connection restored."
-    );
-    reconnectAttempt = 0;
-  }
-  function beginDeferredPendingCloseLog(code, reason) {
+// src/auth/pending/pending-auth-on-close.ts
+function createPendingAuthOnClose(params) {
+  const { session, log: log2, connect } = params;
+  return (code, reason) => {
+    if (session.keepaliveInterval) {
+      clearInterval(session.keepaliveInterval);
+      session.keepaliveInterval = null;
+    }
+    if (session.resolved) return;
     beginDeferredDisconnectForReconnect({
-      isClosedByUser: () => resolved,
-      quiet: signInQuiet,
+      isClosedByUser: () => session.resolved,
+      quiet: session.signInQuiet,
       code,
       reason,
       willReconnect: true,
-      log: logFn,
+      log: log2,
       serviceLabel: "[Bridge service]",
       shutdownDetail: "Not reconnecting (shutting down).",
       reconnectingDetail: "Waiting for browser sign-in; reconnecting\u2026",
-      shouldAbortQuietWindow: () => ws != null && ws.readyState === wrapper_default.OPEN
+      shouldAbortQuietWindow: () => session.ws != null && session.ws.readyState === wrapper_default.OPEN
     });
-  }
-  function cleanup() {
-    clearReconnectQuietTimer(signInQuiet);
-    if (reconnectTimeout) {
-      clearTimeout(reconnectTimeout);
-      reconnectTimeout = null;
-    }
-    if (browserFallback) {
-      clearTimeout(browserFallback);
-      browserFallback = null;
-    }
-    if (keepaliveInterval) {
-      clearInterval(keepaliveInterval);
-      keepaliveInterval = null;
-    }
-    if (ws) {
-      const w = ws;
-      ws = null;
-      safeCloseWebSocket(w);
+    const delay4 = pendingAuthReconnectDelayMs(session.reconnectAttempt);
+    session.reconnectAttempt += 1;
+    if (session.signInQuiet.verboseLogs) {
+      const delayLabel = formatReconnectDelayForLog(delay4);
+      log2(
+        `[Bridge service] Next sign-in connection attempt in ${delayLabel} (attempt ${session.reconnectAttempt}).`
+      );
     }
+    session.reconnectTimeout = setTimeout(() => {
+      session.reconnectTimeout = null;
+      connect();
+    }, delay4);
+  };
+}
+
+// src/auth/pending/pending-auth-session.ts
+function createPendingAuthSession() {
+  let resolveAuth;
+  const authPromise = new Promise((resolve37) => {
+    resolveAuth = resolve37;
+  });
+  return {
+    ws: null,
+    reconnectTimeout: null,
+    keepaliveInterval: null,
+    browserFallback: null,
+    connectionId: crypto.randomUUID(),
+    hasOpenedBrowser: false,
+    resolved: false,
+    resolveAuth,
+    reconnectAttempt: 0,
+    signInQuiet: createEmptyReconnectQuietSlot(),
+    authPromise
+  };
+}
+function cleanupPendingAuthSession(session) {
+  clearReconnectQuietTimer(session.signInQuiet);
+  if (session.reconnectTimeout) {
+    clearTimeout(session.reconnectTimeout);
+    session.reconnectTimeout = null;
   }
-  function connect() {
-    const url2 = buildPendingBridgeUrl(apiUrl, connectionId);
-    let pendingHbSeq = -1;
-    ws = createWsBridge({
-      url: url2,
-      onOpen: () => {
-        clearQuietOnOpen();
-        pendingHbSeq = -1;
-        sendWsMessage(ws, { type: "identify", role: "cli", cliVersion: CLI_VERSION });
-        keepaliveInterval = setInterval(() => {
-          if (resolved || !ws || ws.readyState !== 1) return;
-          pendingHbSeq = pendingHbSeq >= BRIDGE_HEARTBEAT_SEQ_MAX ? 0 : pendingHbSeq + 1;
-          const hb = { t: "h", s: pendingHbSeq };
-          sendWsMessage(ws, hb);
-        }, PENDING_KEEPALIVE_MS);
-        if (browserFallback) {
-          clearTimeout(browserFallback);
-          browserFallback = null;
-        }
-        if (!hasOpenedBrowser) {
-          hasOpenedBrowser = true;
-          void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
-        }
-      },
-      onClose: (code, reason) => {
-        if (keepaliveInterval) {
-          clearInterval(keepaliveInterval);
-          keepaliveInterval = null;
-        }
-        if (resolved) return;
-        beginDeferredPendingCloseLog(code, reason);
-        const delay4 = pendingAuthReconnectDelayMs(reconnectAttempt);
-        reconnectAttempt += 1;
-        if (signInQuiet.verboseLogs) {
-          const delayLabel = formatReconnectDelayForLog(delay4);
-          logFn(
-            `[Bridge service] Next sign-in connection attempt in ${delayLabel} (attempt ${reconnectAttempt}).`
-          );
-        }
-        reconnectTimeout = setTimeout(() => {
-          reconnectTimeout = null;
-          connect();
-        }, delay4);
-      },
-      onError: (err) => logCliWebSocketError(logFn, "[Bridge service]", err, "while waiting for sign-in"),
-      onMessage: (data) => {
-        const msg = data;
-        if (msg.type === "auth_token" && typeof msg.token === "string") {
-          resolved = true;
-          const workspaceId = typeof msg.workspaceId === "string" ? msg.workspaceId : "";
-          cleanup();
-          const refreshToken = typeof msg.refreshToken === "string" ? msg.refreshToken : void 0;
-          const result = { workspaceId, token: msg.token, refreshToken };
-          resolveAuth(result);
-          onAuth(result);
-        }
-      }
-    });
+  if (session.browserFallback) {
+    clearTimeout(session.browserFallback);
+    session.browserFallback = null;
   }
-  browserFallback = setTimeout(() => {
-    browserFallback = null;
-    if (!hasOpenedBrowser) {
-      hasOpenedBrowser = true;
-      void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+  if (session.keepaliveInterval) {
+    clearInterval(session.keepaliveInterval);
+    session.keepaliveInterval = null;
+  }
+  if (session.ws) {
+    const w = session.ws;
+    session.ws = null;
+    safeCloseWebSocket(w);
+  }
+}
+
+// src/auth/pending/pending-auth-on-message.ts
+function createPendingAuthOnMessage(params) {
+  const { session, onAuth } = params;
+  return (data) => {
+    const msg = data;
+    if (msg.type !== "auth_token" || typeof msg.token !== "string") return;
+    session.resolved = true;
+    const workspaceId = typeof msg.workspaceId === "string" ? msg.workspaceId : "";
+    const refreshToken = typeof msg.refreshToken === "string" ? msg.refreshToken : void 0;
+    const result = { workspaceId, token: msg.token, refreshToken };
+    session.resolveAuth(result);
+    onAuth(result);
+    cleanupPendingAuthSession(session);
+  };
+}
+
+// src/auth/pending/pending-auth-on-open.ts
+function createPendingAuthOnOpen(params) {
+  const { session, apiUrl, initialWorkspaceId, preferredBridgeName, log: log2 } = params;
+  let pendingHbSeq = -1;
+  return () => {
+    clearReconnectQuietOnSuccessfulConnection(
+      session.signInQuiet,
+      log2,
+      "[Bridge service] Sign-in connection restored."
+    );
+    session.reconnectAttempt = 0;
+    pendingHbSeq = -1;
+    sendWsMessage(session.ws, { type: "identify", role: "cli", cliVersion: CLI_VERSION });
+    session.keepaliveInterval = setInterval(() => {
+      if (session.resolved || !session.ws || session.ws.readyState !== 1) return;
+      pendingHbSeq = pendingHbSeq >= BRIDGE_HEARTBEAT_SEQ_MAX ? 0 : pendingHbSeq + 1;
+      const hb = { t: "h", s: pendingHbSeq };
+      sendWsMessage(session.ws, hb);
+    }, PENDING_KEEPALIVE_MS);
+    if (session.browserFallback) {
+      clearTimeout(session.browserFallback);
+      session.browserFallback = null;
+    }
+    if (!session.hasOpenedBrowser) {
+      session.hasOpenedBrowser = true;
+      void openBrowser(session.connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, log2);
+    }
+  };
+}
+
+// src/auth/pending/connect-pending-auth.ts
+function connectPendingAuth(params) {
+  const { session, apiUrl, initialWorkspaceId, preferredBridgeName, onAuth, log: log2 } = params;
+  const connect = () => {
+    session.ws = createWsBridge({
+      url: buildPendingBridgeUrl(apiUrl, session.connectionId),
+      deferInboundMessages: false,
+      onOpen: createPendingAuthOnOpen({
+        session,
+        apiUrl,
+        initialWorkspaceId,
+        preferredBridgeName,
+        log: log2
+      }),
+      onClose: createPendingAuthOnClose({ session, log: log2, connect }),
+      onError: (err) => logCliWebSocketError(log2, "[Bridge service]", err, "while waiting for sign-in"),
+      onMessage: createPendingAuthOnMessage({ session, onAuth })
+    });
+  };
+  connect();
+}
+
+// src/auth/pending/run-pending-auth.ts
+function runPendingAuth(options) {
+  const { apiUrl, initialWorkspaceId, preferredBridgeName, onAuth } = options;
+  const logFn = options.log ?? log;
+  const session = createPendingAuthSession();
+  session.browserFallback = setTimeout(() => {
+    session.browserFallback = null;
+    if (!session.hasOpenedBrowser) {
+      session.hasOpenedBrowser = true;
+      void openBrowser(session.connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
     }
   }, BROWSER_OPEN_FALLBACK_MS);
-  connect();
+  connectPendingAuth({
+    session,
+    apiUrl,
+    initialWorkspaceId,
+    preferredBridgeName,
+    onAuth,
+    log: logFn
+  });
   return {
     close: () => {
-      if (!resolved) resolveAuth(null);
-      cleanup();
+      if (!session.resolved) session.resolveAuth(null);
+      cleanupPendingAuthSession(session);
     },
-    authPromise
+    authPromise: session.authPromise
   };
 }
 
@@ -34953,6 +35016,31 @@ function getAgentModelFromAgentConfig(config2) {
 var HOUR_MS = 36e5;
 var DAY_MS = 24 * HOUR_MS;
 
+// ../types/src/hosts/skus.ts
+function defineHostSku(params) {
+  return structuredClone(params);
+}
+var FLY_LEGACY_HOST_SKU = defineHostSku({
+  id: "fly-shared-1x512-1gb",
+  provider: "fly",
+  compute: { cpus: 1, cpuKind: "shared" },
+  memory: { memoryMb: 512 },
+  storage: { storageGb: 1 },
+  monthlyPriceCents: 750
+});
+var FLY_DEFAULT_HOST_SKU = defineHostSku({
+  id: "fly-shared-1x1024-1gb",
+  provider: "fly",
+  compute: { cpus: 1, cpuKind: "shared" },
+  memory: { memoryMb: 1024 },
+  storage: { storageGb: 1 },
+  monthlyPriceCents: 1e3
+});
+var HOST_SKUS_BY_ID = {
+  [FLY_LEGACY_HOST_SKU.id]: FLY_LEGACY_HOST_SKU,
+  [FLY_DEFAULT_HOST_SKU.id]: FLY_DEFAULT_HOST_SKU
+};
+
 // ../types/src/bridges/agents/types.ts
 var INSTALLABLE_BRIDGE_AGENTS = [
   { value: "claude-code", label: "Anthropic Claude Code", tokenLabel: "Anthropic API key", tokenEnvVar: "ANTHROPIC_API_KEY" },
@@ -35453,11 +35541,11 @@ function createSdkStdioExtNotificationHandler(options) {
 
 // src/agents/acp/clients/sdk/sdk-stdio-permission-request-handshake.ts
 function awaitSdkStdioPermissionRequestHandshake(params) {
-  const { requestId, paramsRecord, pending, onRequest } = params;
+  const { requestId, paramsRecord, pending: pending2, onRequest } = params;
   return new Promise((resolve37) => {
-    pending.set(requestId, { resolve: resolve37, params: paramsRecord });
+    pending2.set(requestId, { resolve: resolve37, params: paramsRecord });
     if (onRequest == null) {
-      pending.delete(requestId);
+      pending2.delete(requestId);
       resolve37({ outcome: { outcome: "denied" } });
       return;
     }
@@ -35473,9 +35561,9 @@ function awaitSdkStdioPermissionRequestHandshake(params) {
 }
 
 // src/agents/acp/clients/sdk/sdk-stdio-permission-pending.ts
-function resolvePendingSdkStdioPermissionCancellations(pending) {
-  for (const [id, entry] of [...pending.entries()]) {
-    pending.delete(id);
+function resolvePendingSdkStdioPermissionCancellations(pending2) {
+  for (const [id, entry] of [...pending2.entries()]) {
+    pending2.delete(id);
     entry.resolve({ outcome: { outcome: "cancelled" } });
   }
 }
@@ -36201,8 +36289,8 @@ function createCursorAcpSessionContext(options) {
 
 // src/agents/acp/clients/cursor/cancel-pending-cursor-permission-requests.ts
 function cancelPendingCursorPermissionRequests(pendingRequests2, respond) {
-  for (const [reqId, pending] of [...pendingRequests2.entries()]) {
-    if (pending.method === "session/request_permission") {
+  for (const [reqId, pending2] of [...pendingRequests2.entries()]) {
+    if (pending2.method === "session/request_permission") {
       respond(reqId, { outcome: { outcome: "cancelled" } });
       pendingRequests2.delete(reqId);
     }
@@ -36394,8 +36482,8 @@ function handleCursorIncomingPermissionRequest(id, method, msg, deps) {
 
 // src/agents/acp/clients/cursor/cursor-incoming-resolve-request.ts
 function resolveCursorIncomingRequest(pendingRequests2, respond, requestId, result) {
-  const pending = pendingRequests2.get(requestId);
-  const payload = pending?.method === "session/request_permission" ? enrichAcpPermissionRpcResultFromRequestParams(result, pending.params) : result;
+  const pending2 = pendingRequests2.get(requestId);
+  const payload = pending2?.method === "session/request_permission" ? enrichAcpPermissionRpcResultFromRequestParams(result, pending2.params) : result;
   respond(requestId, payload);
   pendingRequests2.delete(requestId);
 }
@@ -36533,25 +36621,25 @@ function createCursorJsonRpcInboundRespond(stdin) {
 
 // src/agents/acp/clients/cursor/cursor-json-rpc-outbound.ts
 function createCursorJsonRpcOutboundPending() {
-  const pending = /* @__PURE__ */ new Map();
+  const pending2 = /* @__PURE__ */ new Map();
   let nextId = 1;
   function allocateId() {
     return nextId++;
   }
   function register(id, waiter) {
-    pending.set(id, waiter);
+    pending2.set(id, waiter);
   }
   function settleResponse(id, msg) {
-    const waiter = pending.get(id);
+    const waiter = pending2.get(id);
     if (!waiter) return false;
-    pending.delete(id);
+    pending2.delete(id);
     if (msg.error) waiter.reject(msg.error);
     else waiter.resolve(msg.result);
     return true;
   }
   function rejectOnWriteError(id, err) {
-    const waiter = pending.get(id);
-    pending.delete(id);
+    const waiter = pending2.get(id);
+    pending2.delete(id);
     waiter?.reject(err);
   }
   return { allocateId, register, settleResponse, rejectOnWriteError };
@@ -41504,11 +41592,11 @@ function tryConsumeBinaryProxyBody(raw, deps) {
   if (!PROXY_ID_RE.test(id)) return false;
   const body = raw.slice(PROXY_ID_BYTES);
   const bodyBytes = body.length > 0 ? new Uint8Array(body) : new Uint8Array(0);
-  const pending = deps.pendingProxyBody.get(id);
-  if (pending) {
+  const pending2 = deps.pendingProxyBody.get(id);
+  if (pending2) {
     deps.pendingProxyBody.delete(id);
     deps.startStreamingProxy({
-      ...pending.pr,
+      ...pending2.pr,
       body: bodyBytes.length > 0 ? bodyBytes : void 0
     });
     return true;
@@ -41901,9 +41989,9 @@ function processHeartbeatAck(params) {
   if (awaitingSeq === null) return { awaitingSeq, missed: 0 };
   if (!Number.isFinite(seq)) return { awaitingSeq, missed: 0 };
   const ack = Math.trunc(seq);
-  const pending = awaitingSeq;
-  if (ack < pending) return { awaitingSeq, missed: 0 };
-  if (ack === pending) {
+  const pending2 = awaitingSeq;
+  if (ack < pending2) return { awaitingSeq, missed: 0 };
+  if (ack === pending2) {
     recordRtt(Date.now() - sentAtMs);
   }
   return { awaitingSeq: null, missed: 0 };
@@ -52272,18 +52360,62 @@ async function applyPromptQueueStateFromServer(msg, deps) {
   }
 }
 
+// src/agents/acp/from-bridge/pending-prompt-results.ts
+var pending = [];
+function enqueuePendingPromptResult(message) {
+  const runId = typeof message.runId === "string" ? message.runId : "";
+  if (runId) {
+    const idx = pending.findIndex((m) => m.runId === runId);
+    if (idx >= 0) pending.splice(idx, 1);
+  }
+  pending.push(message);
+}
+function flushPendingPromptResults(getWs, encrypt) {
+  if (pending.length === 0) return;
+  const ws = getWs();
+  if (!ws || ws.readyState !== wrapper_default.OPEN) return;
+  const still = [];
+  for (const message of pending) {
+    const wire = encrypt ? encrypt(message) : message;
+    if (!sendWsMessage(ws, wire)) still.push(message);
+  }
+  pending.length = 0;
+  pending.push(...still);
+}
+
+// src/agents/acp/from-bridge/send-session-update-wire.ts
+function sendSessionUpdateWire(getWs, payload, opts) {
+  const s = getWs();
+  if (!s || s.readyState !== wrapper_default.OPEN) {
+    opts.log("[Bridge service] Session update not sent: not connected to the bridge.");
+    return;
+  }
+  const p = payload;
+  const wire = p.type === "session_update" && opts.e2ee ? opts.e2ee.encryptFields(payload, ["payload"]) : p.type === "session_file_change" && opts.e2ee ? opts.e2ee.encryptFields(payload, [
+    "path",
+    "oldText",
+    "newText",
+    "patchContent",
+    "isDirectory",
+    "directoryRemoved"
+  ]) : payload;
+  sendWsMessage(s, wire);
+}
+
 // src/agents/acp/from-bridge/bridge-prompt-wiring.ts
 function createBridgePromptSenders(deps, getWs) {
   const sendBridgeMessage = (message, encryptedFields = []) => {
     const s = getWs();
-    if (!s) return false;
+    if (!s || s.readyState !== wrapper_default.OPEN) return false;
     const wire = deps.e2ee && encryptedFields.length > 0 ? deps.e2ee.encryptFields(message, encryptedFields) : message;
-    sendWsMessage(s, wire);
-    return true;
+    return sendWsMessage(s, wire);
   };
   const sendResult = (result) => {
-    const encryptedFields = result.type === "prompt_result" ? ["output", "error"] : [];
-    sendBridgeMessage(result, encryptedFields);
+    const sent = sendBridgeMessage(result, result.type === "prompt_result" ? ["output", "error"] : []);
+    if (!sent && result.type === "prompt_result") {
+      enqueuePendingPromptResult(result);
+      deps.log("[Bridge service] prompt_result deferred until bridge reconnect.");
+    }
     if (result.type === "prompt_result") {
       const pr = result;
       const cancelled = pr.stopReason === "cancelled";
@@ -52296,24 +52428,11 @@ function createBridgePromptSenders(deps, getWs) {
       });
     }
   };
-  const sendSessionUpdate = (payload) => {
-    const s = getWs();
-    if (!s) {
-      deps.log("[Bridge service] Session update not sent: not connected to the bridge.");
-      return;
-    }
-    const p = payload;
-    const wire = p.type === "session_update" && deps.e2ee ? deps.e2ee.encryptFields(payload, ["payload"]) : p.type === "session_file_change" && deps.e2ee ? deps.e2ee.encryptFields(payload, [
-      "path",
-      "oldText",
-      "newText",
-      "patchContent",
-      "isDirectory",
-      "directoryRemoved"
-    ]) : payload;
-    sendWsMessage(s, wire);
+  return {
+    sendBridgeMessage,
+    sendResult,
+    sendSessionUpdate: (payload) => sendSessionUpdateWire(getWs, payload, { e2ee: deps.e2ee, log: deps.log })
   };
-  return { sendBridgeMessage, sendResult, sendSessionUpdate };
 }
 
 // src/agents/acp/from-bridge/handle-bridge-prompt/parse-bridge-attachments.ts
@@ -53197,25 +53316,59 @@ var handleInstallSkillsMessage = (msg, deps) => {
   })();
 };
 
-// src/agents/install/commands/run-npm-global-install.ts
-import { execFile as execFile9 } from "node:child_process";
-import { promisify as promisify10 } from "node:util";
-
-// src/agents/install/format-command-output.ts
-function formatCommandOutput(stdout, stderr) {
-  const parts = [String(stdout ?? "").trimEnd(), String(stderr ?? "").trimEnd()].filter(Boolean);
-  return parts.join("\n");
+// src/agents/install/run-streaming-command.ts
+import { spawn as spawn11 } from "node:child_process";
+import * as readline3 from "node:readline";
+function runStreamingCommand(command, args, options) {
+  return new Promise((resolve37, reject) => {
+    const child = spawn11(command, args, {
+      env: options.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let settled = false;
+    const timer = options.timeoutMs != null ? setTimeout(() => {
+      child.kill("SIGKILL");
+      if (!settled) {
+        settled = true;
+        reject(new Error(`Command timed out after ${options.timeoutMs}ms`));
+      }
+    }, options.timeoutMs) : null;
+    const onLine = (line) => {
+      if (line.length > 0) options.onLine?.(line);
+    };
+    if (child.stdout) {
+      readline3.createInterface({ input: child.stdout, crlfDelay: Infinity }).on("line", onLine);
+    }
+    if (child.stderr) {
+      readline3.createInterface({ input: child.stderr, crlfDelay: Infinity }).on("line", onLine);
+    }
+    child.on("error", (err) => {
+      if (timer) clearTimeout(timer);
+      if (!settled) {
+        settled = true;
+        reject(err);
+      }
+    });
+    child.on("close", (code, signal) => {
+      if (timer) clearTimeout(timer);
+      if (!settled) {
+        settled = true;
+        resolve37({ code, signal });
+      }
+    });
+  });
 }
 
 // src/agents/install/commands/run-npm-global-install.ts
-var execFileAsync8 = promisify10(execFile9);
-async function runNpmGlobalInstall(packageName, env, timeoutMs = 3e5) {
-  const { stdout, stderr } = await execFileAsync8("npm", ["install", "-g", packageName], {
-    timeout: timeoutMs,
+async function runNpmGlobalInstall(packageName, env, options) {
+  const result = await runStreamingCommand("npm", ["install", "-g", packageName], {
     env: bridgeAgentPathEnv(env),
-    maxBuffer: 10 * 1024 * 1024
+    timeoutMs: options?.timeoutMs ?? 3e5,
+    onLine: options?.onLine
   });
-  return formatCommandOutput(stdout, stderr);
+  if (result.code !== 0) {
+    throw new Error(`npm install -g ${packageName} failed (exit ${result.code ?? "signal"})`);
+  }
 }
 
 // src/agents/install/commands/claude-code.ts
@@ -53223,11 +53376,12 @@ var claudeCodeInstallCommand = {
   agentType: "claude-code",
   detectCommand: "claude",
   async install(ctx) {
-    const logOutput = await runNpmGlobalInstall("@anthropic-ai/claude-code", {
-      ...ctx.env,
-      ANTHROPIC_API_KEY: ctx.authToken
-    });
-    ctx.onProgress?.("Installing Anthropic Claude Code", logOutput || void 0);
+    ctx.onProgress?.("Installing Anthropic Claude Code");
+    await runNpmGlobalInstall(
+      "@anthropic-ai/claude-code",
+      { ...ctx.env, ANTHROPIC_API_KEY: ctx.authToken },
+      { onLine: (line) => ctx.onProgress?.("Installing Anthropic Claude Code", line) }
+    );
   }
 };
 
@@ -53236,34 +53390,34 @@ var codexAcpInstallCommand = {
   agentType: "codex-acp",
   detectCommand: "codex",
   async install(ctx) {
-    const logOutput = await runNpmGlobalInstall("@openai/codex", {
-      ...ctx.env,
-      OPENAI_API_KEY: ctx.authToken
-    });
-    ctx.onProgress?.("Installing Codex", logOutput || void 0);
+    ctx.onProgress?.("Installing Codex");
+    await runNpmGlobalInstall(
+      "@openai/codex",
+      { ...ctx.env, OPENAI_API_KEY: ctx.authToken },
+      { onLine: (line) => ctx.onProgress?.("Installing Codex", line) }
+    );
   }
 };
 
 // src/agents/install/commands/cursor-cli.ts
-import { execFile as execFile10 } from "node:child_process";
-import { promisify as promisify11 } from "node:util";
-var execFileAsync9 = promisify11(execFile10);
 var cursorCliInstallCommand = {
   agentType: "cursor-cli",
   detectCommand: "agent",
   alternateDetectCommands: ["cursor-agent"],
   async install(ctx) {
-    const { stdout, stderr } = await execFileAsync9(
+    ctx.onProgress?.("Installing Cursor CLI");
+    const result = await runStreamingCommand(
       "bash",
       ["-lc", "curl -fsSL https://cursor.com/install | bash"],
       {
-        timeout: 3e5,
+        timeoutMs: 3e5,
         env: { ...bridgeAgentPathEnv(ctx.env), CURSOR_API_KEY: ctx.authToken },
-        maxBuffer: 10 * 1024 * 1024
+        onLine: (line) => ctx.onProgress?.("Installing Cursor CLI", line)
       }
     );
-    const logOutput = formatCommandOutput(stdout, stderr);
-    ctx.onProgress?.("Installing Cursor CLI", logOutput || void 0);
+    if (result.code !== 0) {
+      throw new Error(`Cursor CLI install failed (exit ${result.code ?? "signal"})`);
+    }
   }
 };
 
@@ -53272,11 +53426,12 @@ var opencodeInstallCommand = {
   agentType: "opencode",
   detectCommand: "opencode",
   async install(ctx) {
-    const logOutput = await runNpmGlobalInstall("opencode-ai", {
-      ...ctx.env,
-      OPENCODE_API_KEY: ctx.authToken
-    });
-    ctx.onProgress?.("Installing OpenCode", logOutput || void 0);
+    ctx.onProgress?.("Installing OpenCode");
+    await runNpmGlobalInstall(
+      "opencode-ai",
+      { ...ctx.env, OPENCODE_API_KEY: ctx.authToken },
+      { onLine: (line) => ctx.onProgress?.("Installing OpenCode", line) }
+    );
   }
 };
 
@@ -53337,25 +53492,47 @@ var handleInstallAgentMessage = (msg, deps) => {
   if (!processId || !agentId || !tokenId || !agentType || !authToken) return;
   void (async () => {
     const socket = deps.getWs();
-    const report = (step, message, logOutput) => {
-      if (socket) {
-        sendWsMessage(socket, {
-          type: "install_agent_progress",
-          processId,
-          agentId,
-          tokenId,
-          agentType,
-          step,
-          message,
-          ...logOutput ? { logOutput } : {}
-        });
+    let pendingLines = [];
+    let flushTimer = null;
+    const sendProgress = (message, logOutput) => {
+      if (!socket) return;
+      sendWsMessage(socket, {
+        type: "install_agent_progress",
+        processId,
+        agentId,
+        tokenId,
+        agentType,
+        step: "agent_install_package",
+        message,
+        ...logOutput ? { logOutput } : {}
+      });
+    };
+    const flushLines = (message) => {
+      if (flushTimer) {
+        clearTimeout(flushTimer);
+        flushTimer = null;
       }
+      if (pendingLines.length === 0) return;
+      const logOutput = pendingLines.join("\n");
+      pendingLines = [];
+      sendProgress(message, logOutput);
     };
     const result = await installLocalAgentOnBridge({
       agentType,
       authToken,
-      onProgress: (message, logOutput) => report("agent_install_package", message, logOutput)
+      onProgress: (message, logOutput) => {
+        if (logOutput == null) {
+          flushLines(message);
+          sendProgress(message);
+          return;
+        }
+        pendingLines.push(logOutput);
+        if (!flushTimer) {
+          flushTimer = setTimeout(() => flushLines(message), 100);
+        }
+      }
     });
+    flushLines("Installing agent packages on the bridge machine.");
     if (socket) {
       sendWsMessage(socket, {
         type: "install_agent_result",
@@ -53367,9 +53544,7 @@ var handleInstallAgentMessage = (msg, deps) => {
         error: result.error
       });
     }
-    if (result.success) {
-      await deps.reportAutoDetectedAgents?.();
-    }
+    if (result.success) await deps.reportAutoDetectedAgents?.();
     if (!result.success) {
       deps.log(`[Bridge service] Install agent failed: ${result.error ?? "unknown"}`);
     }
@@ -53954,6 +54129,10 @@ function createMainBridgeOpenHandler(params) {
     if (socket) {
       sendBridgeIdentify(socket, { identifyReportedPaths, e2ee });
       reportGitRepos(getWs, logFn);
+      flushPendingPromptResults(
+        getWs,
+        (message) => e2ee ? e2ee.encryptFields(message, ["output", "error"]) : message
+      );
       try {
         onBridgeSocketOpen?.();
       } catch {
@@ -54098,7 +54277,7 @@ async function createBridgeConnection(options) {
 }
 
 // src/e2e-certificates/key-command.ts
-import * as readline3 from "node:readline";
+import * as readline4 from "node:readline";
 function installE2eCertificateKeyCommand({
   log: log2,
   onOpenCertificate,
@@ -54109,7 +54288,7 @@ function installE2eCertificateKeyCommand({
     return () => {
     };
   }
-  readline3.emitKeypressEvents(process.stdin);
+  readline4.emitKeypressEvents(process.stdin);
   process.stdin.setRawMode(true);
   process.stdin.resume();
   const onKeypress = (str, key) => {
@@ -54150,32 +54329,42 @@ async function openE2eCertificateImportUrl({
   }
 }
 
-// src/run-bridge-connected.ts
+// src/run-bridge-e2ee-key-command.ts
+function installConnectedBridgeE2eeKeyCommand(params) {
+  let openingCertificate = false;
+  return installE2eCertificateKeyCommand({
+    log: params.log,
+    onInterrupt: params.onInterrupt,
+    onOpenCertificate: () => {
+      if (openingCertificate) return;
+      openingCertificate = true;
+      void openE2eCertificateImportUrl({
+        apiUrl: params.apiUrl,
+        workspaceId: params.workspaceId,
+        certificate: params.e2eCertificate,
+        log: params.log
+      }).finally(() => {
+        openingCertificate = false;
+      });
+    }
+  });
+}
+
+// src/run-bridge-connected-signals.ts
+init_log();
 init_cli_process_interrupt();
-init_cli_database();
-async function runConnectedBridge(options, restartWithoutAuth) {
-  const {
-    apiUrl,
-    workspaceId,
-    authToken,
-    refreshToken,
-    justAuthenticated,
-    worktreesRootPath,
-    e2eCertificate
-  } = options;
-  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
-  let cleanupKeyCommand;
-  let bridgeClose = null;
+function installConnectedBridgeSignals(params) {
   let shutdownStarted = false;
   const onSignal = (kind) => {
     requestCliImmediateShutdown();
     abortActiveGitChildProcesses();
-    cleanupKeyCommand?.();
+    params.cleanupKeyCommand();
     if (shutdownStarted) return;
     shutdownStarted = true;
     logImmediate(
       kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
     );
+    const bridgeClose = params.getBridgeClose();
     if (bridgeClose) {
       void bridgeClose().finally(() => process.exit(0));
       return;
@@ -54186,9 +54375,56 @@ async function runConnectedBridge(options, restartWithoutAuth) {
   const onSigTerm = () => onSignal("stop");
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
-  let handle;
+  return {
+    onSigInt,
+    remove: () => {
+      process.off("SIGINT", onSigInt);
+      process.off("SIGTERM", onSigTerm);
+    }
+  };
+}
+
+// src/run-bridge-on-auth-invalid.ts
+init_cli_process_interrupt();
+async function closeBridgeForReauth(params) {
+  params.log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
+  clearConfigForApi(params.apiUrl);
+  await params.close();
+  params.removeSignalHandlers();
+  await clearCliImmediateShutdown();
+  params.endConnectedSession();
+}
+
+// src/run-bridge-connected.ts
+init_cli_database();
+async function runConnectedBridge(options, restartWithoutAuth) {
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    justAuthenticated,
+    worktreesRootPath,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  let cleanupKeyCommand;
+  let bridgeClose = null;
+  let endConnectedSession;
+  const sessionDone = new Promise((resolve37) => {
+    endConnectedSession = resolve37;
+  });
+  let resolveHandleReady;
+  const handleReady = new Promise((resolve37) => {
+    resolveHandleReady = resolve37;
+  });
+  const handleRef = { current: null };
+  const signals = installConnectedBridgeSignals({
+    getBridgeClose: () => bridgeClose,
+    cleanupKeyCommand: () => cleanupKeyCommand?.()
+  });
   try {
-    handle = await createBridgeConnection({
+    const handle = await createBridgeConnection({
       apiUrl,
       workspaceId,
       authToken,
@@ -54207,41 +54443,40 @@ async function runConnectedBridge(options, restartWithoutAuth) {
       },
       onAuthInvalid: () => {
         cleanupKeyCommand?.();
-        log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
-        clearConfigForApi(apiUrl);
-        void handle.close().then(() => {
-          void restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootPath, e2eCertificate });
-        });
+        void (async () => {
+          await handleReady;
+          await closeBridgeForReauth({
+            apiUrl,
+            log,
+            close: async () => {
+              if (handleRef.current) await handleRef.current.close();
+            },
+            removeSignalHandlers: signals.remove,
+            endConnectedSession
+          });
+        })();
       }
     });
-  } catch (e) {
-    process.off("SIGINT", onSigInt);
-    process.off("SIGTERM", onSigTerm);
-    if (e instanceof CliSqliteInterrupted) {
-      process.exit(0);
+    handleRef.current = handle;
+    bridgeClose = () => handle.close();
+    if (e2eCertificate) {
+      cleanupKeyCommand = installConnectedBridgeE2eeKeyCommand({
+        apiUrl,
+        workspaceId,
+        e2eCertificate,
+        log,
+        onInterrupt: signals.onSigInt
+      });
     }
+  } catch (e) {
+    signals.remove();
+    if (e instanceof CliSqliteInterrupted) process.exit(0);
     throw e;
+  } finally {
+    resolveHandleReady();
   }
-  bridgeClose = () => handle.close();
-  if (e2eCertificate) {
-    let openingCertificate = false;
-    cleanupKeyCommand = installE2eCertificateKeyCommand({
-      log,
-      onInterrupt: onSigInt,
-      onOpenCertificate: () => {
-        if (openingCertificate) return;
-        openingCertificate = true;
-        void openE2eCertificateImportUrl({
-          apiUrl,
-          workspaceId,
-          certificate: e2eCertificate,
-          log
-        }).finally(() => {
-          openingCertificate = false;
-        });
-      }
-    });
-  }
+  await sessionDone;
+  await restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootPath, e2eCertificate });
 }
 
 // src/run-bridge.ts
@@ -54285,12 +54520,16 @@ async function runBridge(options) {
     process.off("SIGINT", onSigInt);
     process.off("SIGTERM", onSigTerm);
     handle.close();
-    if (!auth) return;
+    if (!auth) {
+      log("Sign-in ended before a token was received.");
+      return;
+    }
     writeConfigForApi(apiUrl, {
       workspaceId: auth.workspaceId,
       token: auth.token,
       refreshToken: auth.refreshToken
     });
+    log("Link established. Connecting with the new token\u2026");
     await runBridge({
       apiUrl,
       workspaceId: auth.workspaceId,