@buildautomaton/cli 0.1.79 → 0.1.80

package/dist/cli.js

@@ -12522,6 +12522,16 @@ async function awaitSymbolIndexWorkerShutdown() {
     await terminateSymbolIndexWorker2();
   }
 }
+async function clearCliImmediateShutdown() {
+  if (symbolIndexShutdownPromise != null) {
+    try {
+      await symbolIndexShutdownPromise;
+    } catch {
+    }
+  }
+  cliImmediateShutdownRequested = false;
+  symbolIndexShutdownPromise = null;
+}
 function resetCliImmediateShutdownForTests() {
   cliImmediateShutdownRequested = false;
   symbolIndexShutdownPromise = null;
@@ -31071,7 +31081,7 @@ var {
 } = import_index.default;
 
 // src/cli-version.ts
-var CLI_VERSION = "0.1.79".length > 0 ? "0.1.79" : "0.0.0-dev";
+var CLI_VERSION = "0.1.80".length > 0 ? "0.1.80" : "0.0.0-dev";
 
 // src/cli/defaults.ts
 var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
@@ -31533,181 +31543,8 @@ function installBridgeProcessResilience() {
   });
 }
 
-// ../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/wrapper.mjs
-var import_stream = __toESM(require_stream(), 1);
-var import_receiver = __toESM(require_receiver(), 1);
-var import_sender = __toESM(require_sender(), 1);
-var import_websocket = __toESM(require_websocket(), 1);
-var import_websocket_server = __toESM(require_websocket_server(), 1);
-var wrapper_default = import_websocket.default;
-
-// src/connection/cli-ws-client.ts
-import https from "node:https";
-var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
-function attachWebSocketClientPing(ws, intervalMs) {
-  let timer = null;
-  function clear() {
-    if (timer != null) {
-      clearInterval(timer);
-      timer = null;
-    }
-  }
-  clear();
-  timer = setInterval(() => {
-    if (ws.readyState === wrapper_default.OPEN) {
-      try {
-        ws.ping();
-      } catch {
-      }
-    }
-  }, intervalMs);
-  return clear;
-}
-function buildCliWebSocketClientOptions(wsUrl) {
-  const wsOptions = { perMessageDeflate: false };
-  if (wsUrl.startsWith("wss://")) {
-    wsOptions.agent = new https.Agent({ rejectUnauthorized: false });
-  }
-  return wsOptions;
-}
-function logCliWebSocketError(log2, serviceLabel, err, detail) {
-  const mid = detail ? ` ${detail}` : "";
-  log2(`${serviceLabel} WebSocket error${mid}: ${err.message}`);
-}
-function safeCloseWebSocket(ws) {
-  try {
-    if (ws.readyState === wrapper_default.CLOSED) {
-      ws.removeAllListeners();
-      return;
-    }
-    ws.once("close", () => {
-      ws.removeAllListeners();
-    });
-    ws.close();
-  } catch {
-    try {
-      ws.removeAllListeners();
-    } catch {
-    }
-  }
-}
-function safeSendWebSocketBinary(ws, data) {
-  if (ws.readyState !== wrapper_default.OPEN) return false;
-  try {
-    ws.send(data, { binary: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/connection/parse-compact-heartbeat-ack.ts
-function tryParseCompactHeartbeatAck(raw) {
-  let str = null;
-  if (typeof raw === "string") {
-    str = raw;
-  } else if (Buffer.isBuffer(raw)) {
-    str = raw.toString("utf8");
-  } else if (raw instanceof ArrayBuffer) {
-    str = Buffer.from(raw).toString("utf8");
-  } else {
-    return null;
-  }
-  if (str.length > 64 || !str.includes('"ha"')) return null;
-  try {
-    const parsed = JSON.parse(str);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const o = parsed;
-    if (o.t !== "ha") return null;
-    const s = o.s;
-    if (typeof s !== "number" || !Number.isFinite(s)) return null;
-    return Math.trunc(s);
-  } catch {
-    return null;
-  }
-}
-
-// src/connection/create-ws-bridge.ts
-var BRIDGE_AUTH_ERROR_HEADER = "x-bridge-auth-error";
-var BRIDGE_AUTH_ERROR_TOKEN_INVALID = "token_invalid";
-function createWsBridge(options) {
-  const {
-    url: url2,
-    onMessage,
-    onOpen,
-    onClose,
-    onError: onError2,
-    onAuthInvalid,
-    clientPingIntervalMs,
-    onCompactHeartbeatAck,
-    isActiveSocket
-  } = options;
-  const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
-  let clearClientPing = null;
-  function disposeClientPing() {
-    clearClientPing?.();
-    clearClientPing = null;
-  }
-  ws.on("unexpected-response", (request, response) => {
-    const status = response?.statusCode ?? 0;
-    const headers = response?.headers ?? {};
-    const errCode = (headers[BRIDGE_AUTH_ERROR_HEADER] ?? headers["X-Bridge-Auth-Error"] ?? "").toLowerCase();
-    if (status === 401 && errCode === BRIDGE_AUTH_ERROR_TOKEN_INVALID) {
-      void Promise.resolve(onAuthInvalid?.());
-    }
-  });
-  ws.on("open", () => {
-    disposeClientPing();
-    if (clientPingIntervalMs != null && clientPingIntervalMs > 0) {
-      clearClientPing = attachWebSocketClientPing(ws, clientPingIntervalMs);
-    }
-    onOpen?.();
-  });
-  ws.on("message", (raw) => {
-    const ackSeq = tryParseCompactHeartbeatAck(raw);
-    if (ackSeq != null) {
-      onCompactHeartbeatAck?.(ackSeq);
-      return;
-    }
-    setImmediate(() => {
-      if (isActiveSocket && !isActiveSocket(ws)) return;
-      try {
-        let data;
-        if (typeof raw === "string") {
-          data = JSON.parse(raw);
-        } else if (Buffer.isBuffer(raw) || raw instanceof ArrayBuffer) {
-          const str = Buffer.isBuffer(raw) ? raw.toString("utf8") : Buffer.from(raw).toString("utf8");
-          data = JSON.parse(str);
-        } else {
-          data = raw;
-        }
-        onMessage?.(data, ws);
-      } catch {
-        onMessage?.(raw, ws);
-      }
-    });
-  });
-  ws.on("close", (code, reason) => {
-    disposeClientPing();
-    onClose?.(code, reason.toString());
-  });
-  ws.on("error", (err) => {
-    disposeClientPing();
-    onError2?.(err);
-  });
-  return ws;
-}
-function sendWsMessage(ws, payload) {
-  if (ws.readyState !== wrapper_default.OPEN) return false;
-  ws.send(JSON.stringify(payload));
-  return true;
-}
-
-// src/connection/heartbeat/constants.ts
-var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
-var BRIDGE_HEARTBEAT_SEQ_MAX = 2147483646;
-var BRIDGE_HEARTBEAT_MISSED_ACKS_BEFORE_RECONNECT = 4;
-var BRIDGE_HEARTBEAT_RTT_SAMPLE_MAX = 5;
+// src/auth/pending/run-pending-auth.ts
+init_log();
 
 // ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
 import process7 from "node:process";
@@ -32262,8 +32099,196 @@ async function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName
   }
 }
 
-// src/auth/run-pending-auth.ts
-init_log();
+// src/auth/pending/constants.ts
+var PENDING_KEEPALIVE_MS = 25e3;
+var BROWSER_OPEN_FALLBACK_MS = 4e3;
+
+// ../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/wrapper.mjs
+var import_stream = __toESM(require_stream(), 1);
+var import_receiver = __toESM(require_receiver(), 1);
+var import_sender = __toESM(require_sender(), 1);
+var import_websocket = __toESM(require_websocket(), 1);
+var import_websocket_server = __toESM(require_websocket_server(), 1);
+var wrapper_default = import_websocket.default;
+
+// src/connection/cli-ws-client.ts
+import https from "node:https";
+var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
+function attachWebSocketClientPing(ws, intervalMs) {
+  let timer = null;
+  function clear() {
+    if (timer != null) {
+      clearInterval(timer);
+      timer = null;
+    }
+  }
+  clear();
+  timer = setInterval(() => {
+    if (ws.readyState === wrapper_default.OPEN) {
+      try {
+        ws.ping();
+      } catch {
+      }
+    }
+  }, intervalMs);
+  return clear;
+}
+function buildCliWebSocketClientOptions(wsUrl) {
+  const wsOptions = { perMessageDeflate: false };
+  if (wsUrl.startsWith("wss://")) {
+    wsOptions.agent = new https.Agent({ rejectUnauthorized: false });
+  }
+  return wsOptions;
+}
+function logCliWebSocketError(log2, serviceLabel, err, detail) {
+  const mid = detail ? ` ${detail}` : "";
+  log2(`${serviceLabel} WebSocket error${mid}: ${err.message}`);
+}
+function safeCloseWebSocket(ws) {
+  try {
+    if (ws.readyState === wrapper_default.CLOSED) {
+      ws.removeAllListeners();
+      return;
+    }
+    ws.once("close", () => {
+      ws.removeAllListeners();
+    });
+    ws.close();
+  } catch {
+    try {
+      ws.removeAllListeners();
+    } catch {
+    }
+  }
+}
+function safeSendWebSocketBinary(ws, data) {
+  if (ws.readyState !== wrapper_default.OPEN) return false;
+  try {
+    ws.send(data, { binary: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/connection/create-ws-bridge-options.ts
+var BRIDGE_AUTH_ERROR_HEADER = "x-bridge-auth-error";
+var BRIDGE_AUTH_ERROR_TOKEN_INVALID = "token_invalid";
+
+// src/connection/dispatch-ws-inbound-message.ts
+function dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket) {
+  if (isActiveSocket && !isActiveSocket(ws)) return;
+  try {
+    let data;
+    if (typeof raw === "string") {
+      data = JSON.parse(raw);
+    } else if (Buffer.isBuffer(raw) || raw instanceof ArrayBuffer) {
+      const str = Buffer.isBuffer(raw) ? raw.toString("utf8") : Buffer.from(raw).toString("utf8");
+      data = JSON.parse(str);
+    } else {
+      data = raw;
+    }
+    onMessage?.(data, ws);
+  } catch {
+    onMessage?.(raw, ws);
+  }
+}
+
+// src/connection/parse-compact-heartbeat-ack.ts
+function tryParseCompactHeartbeatAck(raw) {
+  let str = null;
+  if (typeof raw === "string") {
+    str = raw;
+  } else if (Buffer.isBuffer(raw)) {
+    str = raw.toString("utf8");
+  } else if (raw instanceof ArrayBuffer) {
+    str = Buffer.from(raw).toString("utf8");
+  } else {
+    return null;
+  }
+  if (str.length > 64 || !str.includes('"ha"')) return null;
+  try {
+    const parsed = JSON.parse(str);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const o = parsed;
+    if (o.t !== "ha") return null;
+    const s = o.s;
+    if (typeof s !== "number" || !Number.isFinite(s)) return null;
+    return Math.trunc(s);
+  } catch {
+    return null;
+  }
+}
+
+// src/connection/create-ws-bridge.ts
+function createWsBridge(options) {
+  const {
+    url: url2,
+    onMessage,
+    onOpen,
+    onClose,
+    onError: onError2,
+    onAuthInvalid,
+    clientPingIntervalMs,
+    onCompactHeartbeatAck,
+    isActiveSocket,
+    deferInboundMessages = true
+  } = options;
+  const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
+  let clearClientPing = null;
+  const disposeClientPing = () => {
+    clearClientPing?.();
+    clearClientPing = null;
+  };
+  ws.on("unexpected-response", (_request, response) => {
+    const status = response?.statusCode ?? 0;
+    const headers = response?.headers ?? {};
+    const errCode = (headers[BRIDGE_AUTH_ERROR_HEADER] ?? headers["X-Bridge-Auth-Error"] ?? "").toLowerCase();
+    if (status === 401 && errCode === BRIDGE_AUTH_ERROR_TOKEN_INVALID) {
+      void Promise.resolve(onAuthInvalid?.());
+    }
+  });
+  ws.on("open", () => {
+    disposeClientPing();
+    if (clientPingIntervalMs != null && clientPingIntervalMs > 0) {
+      clearClientPing = attachWebSocketClientPing(ws, clientPingIntervalMs);
+    }
+    onOpen?.();
+  });
+  ws.on("message", (raw) => {
+    const ackSeq = tryParseCompactHeartbeatAck(raw);
+    if (ackSeq != null) {
+      onCompactHeartbeatAck?.(ackSeq);
+      return;
+    }
+    if (deferInboundMessages) {
+      setImmediate(() => dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket));
+      return;
+    }
+    dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket);
+  });
+  ws.on("close", (code, reason) => {
+    disposeClientPing();
+    onClose?.(code, reason.toString());
+  });
+  ws.on("error", (err) => {
+    disposeClientPing();
+    onError2?.(err);
+  });
+  return ws;
+}
+function sendWsMessage(ws, payload) {
+  if (ws.readyState !== wrapper_default.OPEN) return false;
+  ws.send(JSON.stringify(payload));
+  return true;
+}
+
+// src/auth/pending/build-pending-bridge-url.ts
+function buildPendingBridgeUrl(apiUrl, connectionId) {
+  const base = apiUrl.startsWith("https") ? apiUrl.replace(/^https/, "wss") : apiUrl.replace(/^http/, "ws");
+  const params = new URLSearchParams({ connectionId });
+  return `${base}/ws/bridge/pending?${params.toString()}`;
+}
 
 // src/connection/reconnect/constants.ts
 var RECONNECT_QUIET_MS = 2e3;
@@ -32594,6 +32619,12 @@ function scheduleMainBridgeReconnect(state, connect, log2, closeMeta) {
   });
 }
 
+// src/connection/heartbeat/constants.ts
+var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
+var BRIDGE_HEARTBEAT_SEQ_MAX = 2147483646;
+var BRIDGE_HEARTBEAT_MISSED_ACKS_BEFORE_RECONNECT = 4;
+var BRIDGE_HEARTBEAT_RTT_SAMPLE_MAX = 5;
+
 // src/connection/reconnect/duplicate-bridge-connection-detect.ts
 var BRIDGE_SUPERSEDED_CLOSE_REASON_SNIPPET = "superseded";
 var DUPLICATE_BRIDGE_SHORT_SESSION_MS = 25e3;
@@ -32678,145 +32709,177 @@ function clearFirehoseReconnectQuietOnOpen(ctx, log2) {
   });
 }
 
-// src/auth/run-pending-auth.ts
-var PENDING_KEEPALIVE_MS = 25e3;
-var BROWSER_OPEN_FALLBACK_MS = 4e3;
-function buildPendingBridgeUrl(apiUrl, connectionId) {
-  const base = apiUrl.startsWith("https") ? apiUrl.replace(/^https/, "wss") : apiUrl.replace(/^http/, "ws");
-  const params = new URLSearchParams({ connectionId });
-  return `${base}/ws/bridge/pending?${params.toString()}`;
-}
-function runPendingAuth(options) {
-  const { apiUrl, initialWorkspaceId, preferredBridgeName, onAuth } = options;
-  const logFn = options.log ?? log;
-  let ws = null;
-  let reconnectTimeout = null;
-  let keepaliveInterval = null;
-  let browserFallback = null;
-  const connectionId = crypto.randomUUID();
-  let hasOpenedBrowser = false;
-  let resolved = false;
-  let resolveAuth;
-  const authPromise = new Promise((resolve37) => {
-    resolveAuth = resolve37;
-  });
-  let reconnectAttempt = 0;
-  const signInQuiet = createEmptyReconnectQuietSlot();
-  function clearQuietOnOpen() {
-    clearReconnectQuietOnSuccessfulConnection(
-      signInQuiet,
-      logFn,
-      "[Bridge service] Sign-in connection restored."
-    );
-    reconnectAttempt = 0;
-  }
-  function beginDeferredPendingCloseLog(code, reason) {
+// src/auth/pending/pending-auth-on-close.ts
+function createPendingAuthOnClose(params) {
+  const { session, log: log2, connect } = params;
+  return (code, reason) => {
+    if (session.keepaliveInterval) {
+      clearInterval(session.keepaliveInterval);
+      session.keepaliveInterval = null;
+    }
+    if (session.resolved) return;
     beginDeferredDisconnectForReconnect({
-      isClosedByUser: () => resolved,
-      quiet: signInQuiet,
+      isClosedByUser: () => session.resolved,
+      quiet: session.signInQuiet,
       code,
       reason,
       willReconnect: true,
-      log: logFn,
+      log: log2,
       serviceLabel: "[Bridge service]",
       shutdownDetail: "Not reconnecting (shutting down).",
       reconnectingDetail: "Waiting for browser sign-in; reconnecting\u2026",
-      shouldAbortQuietWindow: () => ws != null && ws.readyState === wrapper_default.OPEN
+      shouldAbortQuietWindow: () => session.ws != null && session.ws.readyState === wrapper_default.OPEN
     });
-  }
-  function cleanup() {
-    clearReconnectQuietTimer(signInQuiet);
-    if (reconnectTimeout) {
-      clearTimeout(reconnectTimeout);
-      reconnectTimeout = null;
-    }
-    if (browserFallback) {
-      clearTimeout(browserFallback);
-      browserFallback = null;
-    }
-    if (keepaliveInterval) {
-      clearInterval(keepaliveInterval);
-      keepaliveInterval = null;
-    }
-    if (ws) {
-      const w = ws;
-      ws = null;
-      safeCloseWebSocket(w);
+    const delay4 = pendingAuthReconnectDelayMs(session.reconnectAttempt);
+    session.reconnectAttempt += 1;
+    if (session.signInQuiet.verboseLogs) {
+      const delayLabel = formatReconnectDelayForLog(delay4);
+      log2(
+        `[Bridge service] Next sign-in connection attempt in ${delayLabel} (attempt ${session.reconnectAttempt}).`
+      );
     }
+    session.reconnectTimeout = setTimeout(() => {
+      session.reconnectTimeout = null;
+      connect();
+    }, delay4);
+  };
+}
+
+// src/auth/pending/pending-auth-session.ts
+function createPendingAuthSession() {
+  let resolveAuth;
+  const authPromise = new Promise((resolve37) => {
+    resolveAuth = resolve37;
+  });
+  return {
+    ws: null,
+    reconnectTimeout: null,
+    keepaliveInterval: null,
+    browserFallback: null,
+    connectionId: crypto.randomUUID(),
+    hasOpenedBrowser: false,
+    resolved: false,
+    resolveAuth,
+    reconnectAttempt: 0,
+    signInQuiet: createEmptyReconnectQuietSlot(),
+    authPromise
+  };
+}
+function cleanupPendingAuthSession(session) {
+  clearReconnectQuietTimer(session.signInQuiet);
+  if (session.reconnectTimeout) {
+    clearTimeout(session.reconnectTimeout);
+    session.reconnectTimeout = null;
   }
-  function connect() {
-    const url2 = buildPendingBridgeUrl(apiUrl, connectionId);
-    let pendingHbSeq = -1;
-    ws = createWsBridge({
-      url: url2,
-      onOpen: () => {
-        clearQuietOnOpen();
-        pendingHbSeq = -1;
-        sendWsMessage(ws, { type: "identify", role: "cli", cliVersion: CLI_VERSION });
-        keepaliveInterval = setInterval(() => {
-          if (resolved || !ws || ws.readyState !== 1) return;
-          pendingHbSeq = pendingHbSeq >= BRIDGE_HEARTBEAT_SEQ_MAX ? 0 : pendingHbSeq + 1;
-          const hb = { t: "h", s: pendingHbSeq };
-          sendWsMessage(ws, hb);
-        }, PENDING_KEEPALIVE_MS);
-        if (browserFallback) {
-          clearTimeout(browserFallback);
-          browserFallback = null;
-        }
-        if (!hasOpenedBrowser) {
-          hasOpenedBrowser = true;
-          void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
-        }
-      },
-      onClose: (code, reason) => {
-        if (keepaliveInterval) {
-          clearInterval(keepaliveInterval);
-          keepaliveInterval = null;
-        }
-        if (resolved) return;
-        beginDeferredPendingCloseLog(code, reason);
-        const delay4 = pendingAuthReconnectDelayMs(reconnectAttempt);
-        reconnectAttempt += 1;
-        if (signInQuiet.verboseLogs) {
-          const delayLabel = formatReconnectDelayForLog(delay4);
-          logFn(
-            `[Bridge service] Next sign-in connection attempt in ${delayLabel} (attempt ${reconnectAttempt}).`
-          );
-        }
-        reconnectTimeout = setTimeout(() => {
-          reconnectTimeout = null;
-          connect();
-        }, delay4);
-      },
-      onError: (err) => logCliWebSocketError(logFn, "[Bridge service]", err, "while waiting for sign-in"),
-      onMessage: (data) => {
-        const msg = data;
-        if (msg.type === "auth_token" && typeof msg.token === "string") {
-          resolved = true;
-          const workspaceId = typeof msg.workspaceId === "string" ? msg.workspaceId : "";
-          cleanup();
-          const refreshToken = typeof msg.refreshToken === "string" ? msg.refreshToken : void 0;
-          const result = { workspaceId, token: msg.token, refreshToken };
-          resolveAuth(result);
-          onAuth(result);
-        }
-      }
-    });
+  if (session.browserFallback) {
+    clearTimeout(session.browserFallback);
+    session.browserFallback = null;
   }
-  browserFallback = setTimeout(() => {
-    browserFallback = null;
-    if (!hasOpenedBrowser) {
-      hasOpenedBrowser = true;
-      void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+  if (session.keepaliveInterval) {
+    clearInterval(session.keepaliveInterval);
+    session.keepaliveInterval = null;
+  }
+  if (session.ws) {
+    const w = session.ws;
+    session.ws = null;
+    safeCloseWebSocket(w);
+  }
+}
+
+// src/auth/pending/pending-auth-on-message.ts
+function createPendingAuthOnMessage(params) {
+  const { session, onAuth } = params;
+  return (data) => {
+    const msg = data;
+    if (msg.type !== "auth_token" || typeof msg.token !== "string") return;
+    session.resolved = true;
+    const workspaceId = typeof msg.workspaceId === "string" ? msg.workspaceId : "";
+    const refreshToken = typeof msg.refreshToken === "string" ? msg.refreshToken : void 0;
+    const result = { workspaceId, token: msg.token, refreshToken };
+    session.resolveAuth(result);
+    onAuth(result);
+    cleanupPendingAuthSession(session);
+  };
+}
+
+// src/auth/pending/pending-auth-on-open.ts
+function createPendingAuthOnOpen(params) {
+  const { session, apiUrl, initialWorkspaceId, preferredBridgeName, log: log2 } = params;
+  let pendingHbSeq = -1;
+  return () => {
+    clearReconnectQuietOnSuccessfulConnection(
+      session.signInQuiet,
+      log2,
+      "[Bridge service] Sign-in connection restored."
+    );
+    session.reconnectAttempt = 0;
+    pendingHbSeq = -1;
+    sendWsMessage(session.ws, { type: "identify", role: "cli", cliVersion: CLI_VERSION });
+    session.keepaliveInterval = setInterval(() => {
+      if (session.resolved || !session.ws || session.ws.readyState !== 1) return;
+      pendingHbSeq = pendingHbSeq >= BRIDGE_HEARTBEAT_SEQ_MAX ? 0 : pendingHbSeq + 1;
+      const hb = { t: "h", s: pendingHbSeq };
+      sendWsMessage(session.ws, hb);
+    }, PENDING_KEEPALIVE_MS);
+    if (session.browserFallback) {
+      clearTimeout(session.browserFallback);
+      session.browserFallback = null;
+    }
+    if (!session.hasOpenedBrowser) {
+      session.hasOpenedBrowser = true;
+      void openBrowser(session.connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, log2);
+    }
+  };
+}
+
+// src/auth/pending/connect-pending-auth.ts
+function connectPendingAuth(params) {
+  const { session, apiUrl, initialWorkspaceId, preferredBridgeName, onAuth, log: log2 } = params;
+  const connect = () => {
+    session.ws = createWsBridge({
+      url: buildPendingBridgeUrl(apiUrl, session.connectionId),
+      deferInboundMessages: false,
+      onOpen: createPendingAuthOnOpen({
+        session,
+        apiUrl,
+        initialWorkspaceId,
+        preferredBridgeName,
+        log: log2
+      }),
+      onClose: createPendingAuthOnClose({ session, log: log2, connect }),
+      onError: (err) => logCliWebSocketError(log2, "[Bridge service]", err, "while waiting for sign-in"),
+      onMessage: createPendingAuthOnMessage({ session, onAuth })
+    });
+  };
+  connect();
+}
+
+// src/auth/pending/run-pending-auth.ts
+function runPendingAuth(options) {
+  const { apiUrl, initialWorkspaceId, preferredBridgeName, onAuth } = options;
+  const logFn = options.log ?? log;
+  const session = createPendingAuthSession();
+  session.browserFallback = setTimeout(() => {
+    session.browserFallback = null;
+    if (!session.hasOpenedBrowser) {
+      session.hasOpenedBrowser = true;
+      void openBrowser(session.connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
     }
   }, BROWSER_OPEN_FALLBACK_MS);
-  connect();
+  connectPendingAuth({
+    session,
+    apiUrl,
+    initialWorkspaceId,
+    preferredBridgeName,
+    onAuth,
+    log: logFn
+  });
   return {
     close: () => {
-      if (!resolved) resolveAuth(null);
-      cleanup();
+      if (!session.resolved) session.resolveAuth(null);
+      cleanupPendingAuthSession(session);
     },
-    authPromise
+    authPromise: session.authPromise
   };
 }
 
@@ -54266,32 +54329,42 @@ async function openE2eCertificateImportUrl({
   }
 }
 
-// src/run-bridge-connected.ts
+// src/run-bridge-e2ee-key-command.ts
+function installConnectedBridgeE2eeKeyCommand(params) {
+  let openingCertificate = false;
+  return installE2eCertificateKeyCommand({
+    log: params.log,
+    onInterrupt: params.onInterrupt,
+    onOpenCertificate: () => {
+      if (openingCertificate) return;
+      openingCertificate = true;
+      void openE2eCertificateImportUrl({
+        apiUrl: params.apiUrl,
+        workspaceId: params.workspaceId,
+        certificate: params.e2eCertificate,
+        log: params.log
+      }).finally(() => {
+        openingCertificate = false;
+      });
+    }
+  });
+}
+
+// src/run-bridge-connected-signals.ts
+init_log();
 init_cli_process_interrupt();
-init_cli_database();
-async function runConnectedBridge(options, restartWithoutAuth) {
-  const {
-    apiUrl,
-    workspaceId,
-    authToken,
-    refreshToken,
-    justAuthenticated,
-    worktreesRootPath,
-    e2eCertificate
-  } = options;
-  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
-  let cleanupKeyCommand;
-  let bridgeClose = null;
+function installConnectedBridgeSignals(params) {
   let shutdownStarted = false;
   const onSignal = (kind) => {
     requestCliImmediateShutdown();
     abortActiveGitChildProcesses();
-    cleanupKeyCommand?.();
+    params.cleanupKeyCommand();
     if (shutdownStarted) return;
     shutdownStarted = true;
     logImmediate(
       kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
     );
+    const bridgeClose = params.getBridgeClose();
     if (bridgeClose) {
       void bridgeClose().finally(() => process.exit(0));
       return;
@@ -54302,9 +54375,56 @@ async function runConnectedBridge(options, restartWithoutAuth) {
   const onSigTerm = () => onSignal("stop");
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
-  let handle;
+  return {
+    onSigInt,
+    remove: () => {
+      process.off("SIGINT", onSigInt);
+      process.off("SIGTERM", onSigTerm);
+    }
+  };
+}
+
+// src/run-bridge-on-auth-invalid.ts
+init_cli_process_interrupt();
+async function closeBridgeForReauth(params) {
+  params.log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
+  clearConfigForApi(params.apiUrl);
+  await params.close();
+  params.removeSignalHandlers();
+  await clearCliImmediateShutdown();
+  params.endConnectedSession();
+}
+
+// src/run-bridge-connected.ts
+init_cli_database();
+async function runConnectedBridge(options, restartWithoutAuth) {
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    justAuthenticated,
+    worktreesRootPath,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  let cleanupKeyCommand;
+  let bridgeClose = null;
+  let endConnectedSession;
+  const sessionDone = new Promise((resolve37) => {
+    endConnectedSession = resolve37;
+  });
+  let resolveHandleReady;
+  const handleReady = new Promise((resolve37) => {
+    resolveHandleReady = resolve37;
+  });
+  const handleRef = { current: null };
+  const signals = installConnectedBridgeSignals({
+    getBridgeClose: () => bridgeClose,
+    cleanupKeyCommand: () => cleanupKeyCommand?.()
+  });
   try {
-    handle = await createBridgeConnection({
+    const handle = await createBridgeConnection({
       apiUrl,
       workspaceId,
       authToken,
@@ -54323,41 +54443,40 @@ async function runConnectedBridge(options, restartWithoutAuth) {
       },
       onAuthInvalid: () => {
         cleanupKeyCommand?.();
-        log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
-        clearConfigForApi(apiUrl);
-        void handle.close().then(() => {
-          void restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootPath, e2eCertificate });
-        });
+        void (async () => {
+          await handleReady;
+          await closeBridgeForReauth({
+            apiUrl,
+            log,
+            close: async () => {
+              if (handleRef.current) await handleRef.current.close();
+            },
+            removeSignalHandlers: signals.remove,
+            endConnectedSession
+          });
+        })();
       }
     });
-  } catch (e) {
-    process.off("SIGINT", onSigInt);
-    process.off("SIGTERM", onSigTerm);
-    if (e instanceof CliSqliteInterrupted) {
-      process.exit(0);
+    handleRef.current = handle;
+    bridgeClose = () => handle.close();
+    if (e2eCertificate) {
+      cleanupKeyCommand = installConnectedBridgeE2eeKeyCommand({
+        apiUrl,
+        workspaceId,
+        e2eCertificate,
+        log,
+        onInterrupt: signals.onSigInt
+      });
     }
+  } catch (e) {
+    signals.remove();
+    if (e instanceof CliSqliteInterrupted) process.exit(0);
     throw e;
+  } finally {
+    resolveHandleReady();
   }
-  bridgeClose = () => handle.close();
-  if (e2eCertificate) {
-    let openingCertificate = false;
-    cleanupKeyCommand = installE2eCertificateKeyCommand({
-      log,
-      onInterrupt: onSigInt,
-      onOpenCertificate: () => {
-        if (openingCertificate) return;
-        openingCertificate = true;
-        void openE2eCertificateImportUrl({
-          apiUrl,
-          workspaceId,
-          certificate: e2eCertificate,
-          log
-        }).finally(() => {
-          openingCertificate = false;
-        });
-      }
-    });
-  }
+  await sessionDone;
+  await restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootPath, e2eCertificate });
 }
 
 // src/run-bridge.ts
@@ -54401,12 +54520,16 @@ async function runBridge(options) {
     process.off("SIGINT", onSigInt);
     process.off("SIGTERM", onSigTerm);
     handle.close();
-    if (!auth) return;
+    if (!auth) {
+      log("Sign-in ended before a token was received.");
+      return;
+    }
     writeConfigForApi(apiUrl, {
       workspaceId: auth.workspaceId,
       token: auth.token,
       refreshToken: auth.refreshToken
     });
+    log("Link established. Connecting with the new token\u2026");
     await runBridge({
       apiUrl,
       workspaceId: auth.workspaceId,