@buildautomaton/cli 0.1.79 → 0.1.81

package/dist/cli.js

@@ -973,8 +973,8 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/command.js"(exports) {
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess2 = __require("node:child_process");
-    var path86 = __require("node:path");
-    var fs65 = __require("node:fs");
+    var path88 = __require("node:path");
+    var fs67 = __require("node:fs");
     var process8 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1906,11 +1906,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path86.resolve(baseDir, baseName);
-          if (fs65.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path86.extname(baseName))) return void 0;
+          const localBin = path88.resolve(baseDir, baseName);
+          if (fs67.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path88.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs65.existsSync(`${localBin}${ext}`)
+            (ext) => fs67.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1922,21 +1922,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs65.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs67.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path86.resolve(
-            path86.dirname(resolvedScriptPath),
+          executableDir = path88.resolve(
+            path88.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path86.basename(
+            const legacyName = path88.basename(
               this._scriptPath,
-              path86.extname(this._scriptPath)
+              path88.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1947,7 +1947,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path86.extname(executableFile));
+        launchWithNode = sourceExt.includes(path88.extname(executableFile));
         let proc;
         if (process8.platform !== "win32") {
           if (launchWithNode) {
@@ -2787,7 +2787,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path86.basename(filename, path86.extname(filename));
+        this._name = path88.basename(filename, path88.extname(filename));
         return this;
       }
       /**
@@ -2801,9 +2801,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path87) {
-        if (path87 === void 0) return this._executableDir;
-        this._executableDir = path87;
+      executableDir(path89) {
+        if (path89 === void 0) return this._executableDir;
+        this._executableDir = path89;
         return this;
       }
       /**
@@ -7004,7 +7004,7 @@ var init_activity_tracker = __esm({
 
 // src/runtime/yield-to-event-loop.ts
 function yieldToEventLoop() {
-  return new Promise((resolve37) => setImmediate(resolve37));
+  return new Promise((resolve38) => setImmediate(resolve38));
 }
 var init_yield_to_event_loop = __esm({
   "src/runtime/yield-to-event-loop.ts"() {
@@ -7045,7 +7045,7 @@ async function yieldUntilFileBrowserReadsIdle(pollMs = 5) {
   while (getFileBrowserInFlightReadCount() > 0) {
     await yieldToEventLoop();
     if (getFileBrowserInFlightReadCount() > 0) {
-      await new Promise((resolve37) => setTimeout(resolve37, pollMs));
+      await new Promise((resolve38) => setTimeout(resolve38, pollMs));
     }
   }
 }
@@ -7055,7 +7055,7 @@ async function yieldUntilFileBrowserBrowseIdle(pollMs = 5) {
     const browseCooldownDone = lastActivityAt === 0 || Date.now() - lastActivityAt >= BROWSE_INDEX_COOLDOWN_MS;
     if (inFlightRequests2 === 0 && browseCooldownDone) return;
     await yieldToEventLoop();
-    await new Promise((resolve37) => setTimeout(resolve37, pollMs));
+    await new Promise((resolve38) => setTimeout(resolve38, pollMs));
   }
 }
 async function yieldUntilFileBrowserIdle(pollMs = 5) {
@@ -7232,8 +7232,8 @@ function createRequestId(prefix) {
 }
 function waitForWorkerReady() {
   if (workerReady) return Promise.resolve();
-  return new Promise((resolve37) => {
-    workerReadyWaiters.push(resolve37);
+  return new Promise((resolve38) => {
+    workerReadyWaiters.push(resolve38);
   });
 }
 function registerWorkerReadyListener(listener) {
@@ -7245,7 +7245,7 @@ function registerWorkerReadyListener(listener) {
 }
 function markWorkerReady() {
   workerReady = true;
-  for (const resolve37 of workerReadyWaiters) resolve37();
+  for (const resolve38 of workerReadyWaiters) resolve38();
   workerReadyWaiters = [];
   workerReadyListener?.();
 }
@@ -7392,7 +7392,7 @@ async function waitForOuterCodeNavCacheAccessAsync() {
     if (isCliImmediateShutdownRequested() || isSymbolIndexWorkerShutdownRequested()) {
       throw new CliSqliteInterrupted();
     }
-    await new Promise((resolve37) => setTimeout(resolve37, 5));
+    await new Promise((resolve38) => setTimeout(resolve38, 5));
     await yieldToEventLoop();
   }
 }
@@ -7729,7 +7729,7 @@ function readMigrationSql(filename, ...searchSubdirs) {
     join3(moduleDir, "..", sub, filename),
     join3(moduleDir, "..", "..", "dist", sub, filename)
   ]);
-  const resolved = candidates.find((path86) => existsSync(path86));
+  const resolved = candidates.find((path88) => existsSync(path88));
   if (!resolved) {
     throw new Error(`Missing SQLite migration SQL: ${filename} (searched ${searchSubdirs.join(", ")})`);
   }
@@ -8807,7 +8807,7 @@ var require_ignore = __commonJS({
       //   path matching.
       // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
       // @returns {TestResult} true if a file is ignored
-      test(path86, checkUnignored, mode) {
+      test(path88, checkUnignored, mode) {
         let ignored = false;
         let unignored = false;
         let matchedRule;
@@ -8816,7 +8816,7 @@ var require_ignore = __commonJS({
           if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
             return;
           }
-          const matched = rule[mode].test(path86);
+          const matched = rule[mode].test(path88);
           if (!matched) {
             return;
           }
@@ -8837,17 +8837,17 @@ var require_ignore = __commonJS({
     var throwError = (message, Ctor) => {
       throw new Ctor(message);
     };
-    var checkPath = (path86, originalPath, doThrow) => {
-      if (!isString(path86)) {
+    var checkPath = (path88, originalPath, doThrow) => {
+      if (!isString(path88)) {
         return doThrow(
           `path must be a string, but got \`${originalPath}\``,
           TypeError
         );
       }
-      if (!path86) {
+      if (!path88) {
         return doThrow(`path must not be empty`, TypeError);
       }
-      if (checkPath.isNotRelative(path86)) {
+      if (checkPath.isNotRelative(path88)) {
         const r = "`path.relative()`d";
         return doThrow(
           `path should be a ${r} string, but got "${originalPath}"`,
@@ -8856,7 +8856,7 @@ var require_ignore = __commonJS({
       }
       return true;
     };
-    var isNotRelative = (path86) => REGEX_TEST_INVALID_PATH.test(path86);
+    var isNotRelative = (path88) => REGEX_TEST_INVALID_PATH.test(path88);
     checkPath.isNotRelative = isNotRelative;
     checkPath.convert = (p) => p;
     var Ignore = class {
@@ -8886,19 +8886,19 @@ var require_ignore = __commonJS({
       }
       // @returns {TestResult}
       _test(originalPath, cache2, checkUnignored, slices) {
-        const path86 = originalPath && checkPath.convert(originalPath);
+        const path88 = originalPath && checkPath.convert(originalPath);
         checkPath(
-          path86,
+          path88,
           originalPath,
           this._strictPathCheck ? throwError : RETURN_FALSE
         );
-        return this._t(path86, cache2, checkUnignored, slices);
+        return this._t(path88, cache2, checkUnignored, slices);
       }
-      checkIgnore(path86) {
-        if (!REGEX_TEST_TRAILING_SLASH.test(path86)) {
-          return this.test(path86);
+      checkIgnore(path88) {
+        if (!REGEX_TEST_TRAILING_SLASH.test(path88)) {
+          return this.test(path88);
         }
-        const slices = path86.split(SLASH).filter(Boolean);
+        const slices = path88.split(SLASH).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
@@ -8911,18 +8911,18 @@ var require_ignore = __commonJS({
             return parent;
           }
         }
-        return this._rules.test(path86, false, MODE_CHECK_IGNORE);
+        return this._rules.test(path88, false, MODE_CHECK_IGNORE);
       }
-      _t(path86, cache2, checkUnignored, slices) {
-        if (path86 in cache2) {
-          return cache2[path86];
+      _t(path88, cache2, checkUnignored, slices) {
+        if (path88 in cache2) {
+          return cache2[path88];
         }
         if (!slices) {
-          slices = path86.split(SLASH).filter(Boolean);
+          slices = path88.split(SLASH).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
-          return cache2[path86] = this._rules.test(path86, checkUnignored, MODE_IGNORE);
+          return cache2[path88] = this._rules.test(path88, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
           slices.join(SLASH) + SLASH,
@@ -8930,29 +8930,29 @@ var require_ignore = __commonJS({
           checkUnignored,
           slices
         );
-        return cache2[path86] = parent.ignored ? parent : this._rules.test(path86, checkUnignored, MODE_IGNORE);
+        return cache2[path88] = parent.ignored ? parent : this._rules.test(path88, checkUnignored, MODE_IGNORE);
       }
-      ignores(path86) {
-        return this._test(path86, this._ignoreCache, false).ignored;
+      ignores(path88) {
+        return this._test(path88, this._ignoreCache, false).ignored;
       }
       createFilter() {
-        return (path86) => !this.ignores(path86);
+        return (path88) => !this.ignores(path88);
       }
       filter(paths) {
         return makeArray(paths).filter(this.createFilter());
       }
       // @returns {TestResult}
-      test(path86) {
-        return this._test(path86, this._testCache, true);
+      test(path88) {
+        return this._test(path88, this._testCache, true);
       }
     };
     var factory = (options) => new Ignore(options);
-    var isPathValid = (path86) => checkPath(path86 && checkPath.convert(path86), path86, RETURN_FALSE);
+    var isPathValid = (path88) => checkPath(path88 && checkPath.convert(path88), path88, RETURN_FALSE);
     var setupWindows = () => {
       const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
       checkPath.convert = makePosix;
       const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-      checkPath.isNotRelative = (path86) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path86) || isNotRelative(path86);
+      checkPath.isNotRelative = (path88) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path88) || isNotRelative(path88);
     };
     if (
       // Detect `process` so that it can run in browsers.
@@ -12143,7 +12143,7 @@ var init_setup_handlers = __esm({
 // src/code-nav/symbol-index/worker/handle-message.ts
 async function waitForActiveWorkerHandlersIdle(pollMs = 10) {
   while (activeWorkerHandlers > 0) {
-    await new Promise((resolve37) => setTimeout(resolve37, pollMs));
+    await new Promise((resolve38) => setTimeout(resolve38, pollMs));
   }
 }
 async function handleRequestMessage(port, msg) {
@@ -12386,9 +12386,9 @@ async function requestWorker(message) {
   }
   ensureWorkerStarted();
   await ensureWorkerReadyForRequests();
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     pendingRequests.set(message.requestId, {
-      resolve: (value) => resolve37(value),
+      resolve: (value) => resolve38(value),
       reject
     });
     postToWorker(message);
@@ -12414,37 +12414,37 @@ async function shutdownWorkerThread() {
   if (activeWorker != null) {
     setWorker(null);
     await Promise.race([
-      new Promise((resolve37) => {
+      new Promise((resolve38) => {
         const onMessage = (message) => {
           if (message.type !== "shutdownComplete") return;
           activeWorker.off("message", onMessage);
-          resolve37();
+          resolve38();
         };
         activeWorker.on("message", onMessage);
         try {
           activeWorker.postMessage({ type: "shutdown" });
         } catch {
           activeWorker.off("message", onMessage);
-          resolve37();
+          resolve38();
         }
       }),
-      new Promise((resolve37) => setTimeout(resolve37, WORKER_SHUTDOWN_GRACE_MS))
+      new Promise((resolve38) => setTimeout(resolve38, WORKER_SHUTDOWN_GRACE_MS))
     ]);
     await activeWorker.terminate();
   } else {
     const inProcess = getInProcessBridge();
     if (inProcess != null) {
       await Promise.race([
-        new Promise((resolve37) => {
+        new Promise((resolve38) => {
           const onMessage = (message) => {
             if (message.type !== "shutdownComplete") return;
             inProcess.off("message", onMessage);
-            resolve37();
+            resolve38();
           };
           inProcess.on("message", onMessage);
           inProcess.postMessage({ type: "shutdown" });
         }),
-        new Promise((resolve37) => setTimeout(resolve37, WORKER_SHUTDOWN_GRACE_MS))
+        new Promise((resolve38) => setTimeout(resolve38, WORKER_SHUTDOWN_GRACE_MS))
       ]);
     }
   }
@@ -12522,6 +12522,16 @@ async function awaitSymbolIndexWorkerShutdown() {
     await terminateSymbolIndexWorker2();
   }
 }
+async function clearCliImmediateShutdown() {
+  if (symbolIndexShutdownPromise != null) {
+    try {
+      await symbolIndexShutdownPromise;
+    } catch {
+    }
+  }
+  cliImmediateShutdownRequested = false;
+  symbolIndexShutdownPromise = null;
+}
 function resetCliImmediateShutdownForTests() {
   cliImmediateShutdownRequested = false;
   symbolIndexShutdownPromise = null;
@@ -12958,8 +12968,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path86, errorMaps, issueData } = params;
-      const fullPath = [...path86, ...issueData.path || []];
+      const { data, path: path88, errorMaps, issueData } = params;
+      const fullPath = [...path88, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -13267,11 +13277,11 @@ var init_types2 = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path86, key) {
+      constructor(parent, value, path88, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path86;
+        this._path = path88;
         this._key = key;
       }
       get path() {
@@ -16996,10 +17006,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path86) {
-  if (!path86)
+function getElementAtPath(obj, path88) {
+  if (!path88)
     return obj;
-  return path86.reduce((acc, key) => acc?.[key], obj);
+  return path88.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -17248,11 +17258,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path86, issues) {
+function prefixIssues(path88, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path86);
+    iss.path.unshift(path88);
     return iss;
   });
 }
@@ -17441,7 +17451,7 @@ function treeifyError(error40, _mapper) {
     return issue2.message;
   };
   const result = { errors: [] };
-  const processError = (error41, path86 = []) => {
+  const processError = (error41, path88 = []) => {
     var _a2, _b;
     for (const issue2 of error41.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -17451,7 +17461,7 @@ function treeifyError(error40, _mapper) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path86, ...issue2.path];
+        const fullpath = [...path88, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -17481,9 +17491,9 @@ function treeifyError(error40, _mapper) {
   processError(error40);
   return result;
 }
-function toDotPath(path86) {
+function toDotPath(path88) {
   const segs = [];
-  for (const seg of path86) {
+  for (const seg of path88) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -29946,8 +29956,8 @@ var init_acp = __esm({
         this.#requestHandler = requestHandler;
         this.#notificationHandler = notificationHandler;
         this.#stream = stream;
-        this.#closedPromise = new Promise((resolve37) => {
-          this.#abortController.signal.addEventListener("abort", () => resolve37());
+        this.#closedPromise = new Promise((resolve38) => {
+          this.#abortController.signal.addEventListener("abort", () => resolve38());
         });
         this.#receive();
       }
@@ -30096,8 +30106,8 @@ var init_acp = __esm({
       }
       async sendRequest(method, params) {
         const id = this.#nextRequestId++;
-        const responsePromise = new Promise((resolve37, reject) => {
-          this.#pendingResponses.set(id, { resolve: resolve37, reject });
+        const responsePromise = new Promise((resolve38, reject) => {
+          this.#pendingResponses.set(id, { resolve: resolve38, reject });
         });
         await this.#sendMessage({ jsonrpc: "2.0", id, method, params });
         return responsePromise;
@@ -30966,10 +30976,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault(require_src());
     var log2 = debug_1.default("@kwsites/file-exists");
-    function check2(path86, isFile, isDirectory) {
-      log2(`checking %s`, path86);
+    function check2(path88, isFile, isDirectory) {
+      log2(`checking %s`, path88);
       try {
-        const stat3 = fs_1.statSync(path86);
+        const stat3 = fs_1.statSync(path88);
         if (stat3.isFile() && isFile) {
           log2(`[OK] path represents a file`);
           return true;
@@ -30989,8 +30999,8 @@ var require_src2 = __commonJS({
         throw e;
       }
     }
-    function exists2(path86, type = exports.READABLE) {
-      return check2(path86, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path88, type = exports.READABLE) {
+      return check2(path88, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -31071,7 +31081,7 @@ var {
 } = import_index.default;
 
 // src/cli-version.ts
-var CLI_VERSION = "0.1.79".length > 0 ? "0.1.79" : "0.0.0-dev";
+var CLI_VERSION = "0.1.81".length > 0 ? "0.1.81" : "0.0.0-dev";
 
 // src/cli/defaults.ts
 var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
@@ -31079,8 +31089,8 @@ var DEFAULT_FIREHOSE_URL = "https://buildautomaton-firehose.fly.dev";
 
 // src/cli/run-cli-action.ts
 init_cli_log_level();
-import * as fs64 from "node:fs";
-import * as path85 from "node:path";
+import * as fs66 from "node:fs";
+import * as path87 from "node:path";
 
 // src/config.ts
 import fs from "node:fs";
@@ -31533,181 +31543,8 @@ function installBridgeProcessResilience() {
   });
 }
 
-// ../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/wrapper.mjs
-var import_stream = __toESM(require_stream(), 1);
-var import_receiver = __toESM(require_receiver(), 1);
-var import_sender = __toESM(require_sender(), 1);
-var import_websocket = __toESM(require_websocket(), 1);
-var import_websocket_server = __toESM(require_websocket_server(), 1);
-var wrapper_default = import_websocket.default;
-
-// src/connection/cli-ws-client.ts
-import https from "node:https";
-var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
-function attachWebSocketClientPing(ws, intervalMs) {
-  let timer = null;
-  function clear() {
-    if (timer != null) {
-      clearInterval(timer);
-      timer = null;
-    }
-  }
-  clear();
-  timer = setInterval(() => {
-    if (ws.readyState === wrapper_default.OPEN) {
-      try {
-        ws.ping();
-      } catch {
-      }
-    }
-  }, intervalMs);
-  return clear;
-}
-function buildCliWebSocketClientOptions(wsUrl) {
-  const wsOptions = { perMessageDeflate: false };
-  if (wsUrl.startsWith("wss://")) {
-    wsOptions.agent = new https.Agent({ rejectUnauthorized: false });
-  }
-  return wsOptions;
-}
-function logCliWebSocketError(log2, serviceLabel, err, detail) {
-  const mid = detail ? ` ${detail}` : "";
-  log2(`${serviceLabel} WebSocket error${mid}: ${err.message}`);
-}
-function safeCloseWebSocket(ws) {
-  try {
-    if (ws.readyState === wrapper_default.CLOSED) {
-      ws.removeAllListeners();
-      return;
-    }
-    ws.once("close", () => {
-      ws.removeAllListeners();
-    });
-    ws.close();
-  } catch {
-    try {
-      ws.removeAllListeners();
-    } catch {
-    }
-  }
-}
-function safeSendWebSocketBinary(ws, data) {
-  if (ws.readyState !== wrapper_default.OPEN) return false;
-  try {
-    ws.send(data, { binary: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/connection/parse-compact-heartbeat-ack.ts
-function tryParseCompactHeartbeatAck(raw) {
-  let str = null;
-  if (typeof raw === "string") {
-    str = raw;
-  } else if (Buffer.isBuffer(raw)) {
-    str = raw.toString("utf8");
-  } else if (raw instanceof ArrayBuffer) {
-    str = Buffer.from(raw).toString("utf8");
-  } else {
-    return null;
-  }
-  if (str.length > 64 || !str.includes('"ha"')) return null;
-  try {
-    const parsed = JSON.parse(str);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const o = parsed;
-    if (o.t !== "ha") return null;
-    const s = o.s;
-    if (typeof s !== "number" || !Number.isFinite(s)) return null;
-    return Math.trunc(s);
-  } catch {
-    return null;
-  }
-}
-
-// src/connection/create-ws-bridge.ts
-var BRIDGE_AUTH_ERROR_HEADER = "x-bridge-auth-error";
-var BRIDGE_AUTH_ERROR_TOKEN_INVALID = "token_invalid";
-function createWsBridge(options) {
-  const {
-    url: url2,
-    onMessage,
-    onOpen,
-    onClose,
-    onError: onError2,
-    onAuthInvalid,
-    clientPingIntervalMs,
-    onCompactHeartbeatAck,
-    isActiveSocket
-  } = options;
-  const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
-  let clearClientPing = null;
-  function disposeClientPing() {
-    clearClientPing?.();
-    clearClientPing = null;
-  }
-  ws.on("unexpected-response", (request, response) => {
-    const status = response?.statusCode ?? 0;
-    const headers = response?.headers ?? {};
-    const errCode = (headers[BRIDGE_AUTH_ERROR_HEADER] ?? headers["X-Bridge-Auth-Error"] ?? "").toLowerCase();
-    if (status === 401 && errCode === BRIDGE_AUTH_ERROR_TOKEN_INVALID) {
-      void Promise.resolve(onAuthInvalid?.());
-    }
-  });
-  ws.on("open", () => {
-    disposeClientPing();
-    if (clientPingIntervalMs != null && clientPingIntervalMs > 0) {
-      clearClientPing = attachWebSocketClientPing(ws, clientPingIntervalMs);
-    }
-    onOpen?.();
-  });
-  ws.on("message", (raw) => {
-    const ackSeq = tryParseCompactHeartbeatAck(raw);
-    if (ackSeq != null) {
-      onCompactHeartbeatAck?.(ackSeq);
-      return;
-    }
-    setImmediate(() => {
-      if (isActiveSocket && !isActiveSocket(ws)) return;
-      try {
-        let data;
-        if (typeof raw === "string") {
-          data = JSON.parse(raw);
-        } else if (Buffer.isBuffer(raw) || raw instanceof ArrayBuffer) {
-          const str = Buffer.isBuffer(raw) ? raw.toString("utf8") : Buffer.from(raw).toString("utf8");
-          data = JSON.parse(str);
-        } else {
-          data = raw;
-        }
-        onMessage?.(data, ws);
-      } catch {
-        onMessage?.(raw, ws);
-      }
-    });
-  });
-  ws.on("close", (code, reason) => {
-    disposeClientPing();
-    onClose?.(code, reason.toString());
-  });
-  ws.on("error", (err) => {
-    disposeClientPing();
-    onError2?.(err);
-  });
-  return ws;
-}
-function sendWsMessage(ws, payload) {
-  if (ws.readyState !== wrapper_default.OPEN) return false;
-  ws.send(JSON.stringify(payload));
-  return true;
-}
-
-// src/connection/heartbeat/constants.ts
-var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
-var BRIDGE_HEARTBEAT_SEQ_MAX = 2147483646;
-var BRIDGE_HEARTBEAT_MISSED_ACKS_BEFORE_RECONNECT = 4;
-var BRIDGE_HEARTBEAT_RTT_SAMPLE_MAX = 5;
+// src/auth/pending/run-pending-auth.ts
+init_log();
 
 // ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
 import process7 from "node:process";
@@ -32142,14 +31979,14 @@ var baseOpen = async (options) => {
   }
   const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
   if (options.wait) {
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       subprocess.once("error", reject);
       subprocess.once("close", (exitCode) => {
         if (!options.allowNonzeroExitCode && exitCode > 0) {
           reject(new Error(`Exited with code ${exitCode}`));
           return;
         }
-        resolve37(subprocess);
+        resolve38(subprocess);
       });
     });
   }
@@ -32262,8 +32099,196 @@ async function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName
   }
 }
 
-// src/auth/run-pending-auth.ts
-init_log();
+// src/auth/pending/constants.ts
+var PENDING_KEEPALIVE_MS = 25e3;
+var BROWSER_OPEN_FALLBACK_MS = 4e3;
+
+// ../../node_modules/.pnpm/ws@8.19.0/node_modules/ws/wrapper.mjs
+var import_stream = __toESM(require_stream(), 1);
+var import_receiver = __toESM(require_receiver(), 1);
+var import_sender = __toESM(require_sender(), 1);
+var import_websocket = __toESM(require_websocket(), 1);
+var import_websocket_server = __toESM(require_websocket_server(), 1);
+var wrapper_default = import_websocket.default;
+
+// src/connection/cli-ws-client.ts
+import https from "node:https";
+var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
+function attachWebSocketClientPing(ws, intervalMs) {
+  let timer = null;
+  function clear() {
+    if (timer != null) {
+      clearInterval(timer);
+      timer = null;
+    }
+  }
+  clear();
+  timer = setInterval(() => {
+    if (ws.readyState === wrapper_default.OPEN) {
+      try {
+        ws.ping();
+      } catch {
+      }
+    }
+  }, intervalMs);
+  return clear;
+}
+function buildCliWebSocketClientOptions(wsUrl) {
+  const wsOptions = { perMessageDeflate: false };
+  if (wsUrl.startsWith("wss://")) {
+    wsOptions.agent = new https.Agent({ rejectUnauthorized: false });
+  }
+  return wsOptions;
+}
+function logCliWebSocketError(log2, serviceLabel, err, detail) {
+  const mid = detail ? ` ${detail}` : "";
+  log2(`${serviceLabel} WebSocket error${mid}: ${err.message}`);
+}
+function safeCloseWebSocket(ws) {
+  try {
+    if (ws.readyState === wrapper_default.CLOSED) {
+      ws.removeAllListeners();
+      return;
+    }
+    ws.once("close", () => {
+      ws.removeAllListeners();
+    });
+    ws.close();
+  } catch {
+    try {
+      ws.removeAllListeners();
+    } catch {
+    }
+  }
+}
+function safeSendWebSocketBinary(ws, data) {
+  if (ws.readyState !== wrapper_default.OPEN) return false;
+  try {
+    ws.send(data, { binary: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/connection/create-ws-bridge-options.ts
+var BRIDGE_AUTH_ERROR_HEADER = "x-bridge-auth-error";
+var BRIDGE_AUTH_ERROR_TOKEN_INVALID = "token_invalid";
+
+// src/connection/dispatch-ws-inbound-message.ts
+function dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket) {
+  if (isActiveSocket && !isActiveSocket(ws)) return;
+  try {
+    let data;
+    if (typeof raw === "string") {
+      data = JSON.parse(raw);
+    } else if (Buffer.isBuffer(raw) || raw instanceof ArrayBuffer) {
+      const str = Buffer.isBuffer(raw) ? raw.toString("utf8") : Buffer.from(raw).toString("utf8");
+      data = JSON.parse(str);
+    } else {
+      data = raw;
+    }
+    onMessage?.(data, ws);
+  } catch {
+    onMessage?.(raw, ws);
+  }
+}
+
+// src/connection/parse-compact-heartbeat-ack.ts
+function tryParseCompactHeartbeatAck(raw) {
+  let str = null;
+  if (typeof raw === "string") {
+    str = raw;
+  } else if (Buffer.isBuffer(raw)) {
+    str = raw.toString("utf8");
+  } else if (raw instanceof ArrayBuffer) {
+    str = Buffer.from(raw).toString("utf8");
+  } else {
+    return null;
+  }
+  if (str.length > 64 || !str.includes('"ha"')) return null;
+  try {
+    const parsed = JSON.parse(str);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const o = parsed;
+    if (o.t !== "ha") return null;
+    const s = o.s;
+    if (typeof s !== "number" || !Number.isFinite(s)) return null;
+    return Math.trunc(s);
+  } catch {
+    return null;
+  }
+}
+
+// src/connection/create-ws-bridge.ts
+function createWsBridge(options) {
+  const {
+    url: url2,
+    onMessage,
+    onOpen,
+    onClose,
+    onError: onError2,
+    onAuthInvalid,
+    clientPingIntervalMs,
+    onCompactHeartbeatAck,
+    isActiveSocket,
+    deferInboundMessages = true
+  } = options;
+  const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
+  let clearClientPing = null;
+  const disposeClientPing = () => {
+    clearClientPing?.();
+    clearClientPing = null;
+  };
+  ws.on("unexpected-response", (_request, response) => {
+    const status = response?.statusCode ?? 0;
+    const headers = response?.headers ?? {};
+    const errCode = (headers[BRIDGE_AUTH_ERROR_HEADER] ?? headers["X-Bridge-Auth-Error"] ?? "").toLowerCase();
+    if (status === 401 && errCode === BRIDGE_AUTH_ERROR_TOKEN_INVALID) {
+      void Promise.resolve(onAuthInvalid?.());
+    }
+  });
+  ws.on("open", () => {
+    disposeClientPing();
+    if (clientPingIntervalMs != null && clientPingIntervalMs > 0) {
+      clearClientPing = attachWebSocketClientPing(ws, clientPingIntervalMs);
+    }
+    onOpen?.();
+  });
+  ws.on("message", (raw) => {
+    const ackSeq = tryParseCompactHeartbeatAck(raw);
+    if (ackSeq != null) {
+      onCompactHeartbeatAck?.(ackSeq);
+      return;
+    }
+    if (deferInboundMessages) {
+      setImmediate(() => dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket));
+      return;
+    }
+    dispatchWsInboundMessage(raw, ws, onMessage, isActiveSocket);
+  });
+  ws.on("close", (code, reason) => {
+    disposeClientPing();
+    onClose?.(code, reason.toString());
+  });
+  ws.on("error", (err) => {
+    disposeClientPing();
+    onError2?.(err);
+  });
+  return ws;
+}
+function sendWsMessage(ws, payload) {
+  if (ws.readyState !== wrapper_default.OPEN) return false;
+  ws.send(JSON.stringify(payload));
+  return true;
+}
+
+// src/auth/pending/build-pending-bridge-url.ts
+function buildPendingBridgeUrl(apiUrl, connectionId) {
+  const base = apiUrl.startsWith("https") ? apiUrl.replace(/^https/, "wss") : apiUrl.replace(/^http/, "ws");
+  const params = new URLSearchParams({ connectionId });
+  return `${base}/ws/bridge/pending?${params.toString()}`;
+}
 
 // src/connection/reconnect/constants.ts
 var RECONNECT_QUIET_MS = 2e3;
@@ -32594,6 +32619,12 @@ function scheduleMainBridgeReconnect(state, connect, log2, closeMeta) {
   });
 }
 
+// src/connection/heartbeat/constants.ts
+var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
+var BRIDGE_HEARTBEAT_SEQ_MAX = 2147483646;
+var BRIDGE_HEARTBEAT_MISSED_ACKS_BEFORE_RECONNECT = 4;
+var BRIDGE_HEARTBEAT_RTT_SAMPLE_MAX = 5;
+
 // src/connection/reconnect/duplicate-bridge-connection-detect.ts
 var BRIDGE_SUPERSEDED_CLOSE_REASON_SNIPPET = "superseded";
 var DUPLICATE_BRIDGE_SHORT_SESSION_MS = 25e3;
@@ -32678,145 +32709,177 @@ function clearFirehoseReconnectQuietOnOpen(ctx, log2) {
   });
 }
 
-// src/auth/run-pending-auth.ts
-var PENDING_KEEPALIVE_MS = 25e3;
-var BROWSER_OPEN_FALLBACK_MS = 4e3;
-function buildPendingBridgeUrl(apiUrl, connectionId) {
-  const base = apiUrl.startsWith("https") ? apiUrl.replace(/^https/, "wss") : apiUrl.replace(/^http/, "ws");
-  const params = new URLSearchParams({ connectionId });
-  return `${base}/ws/bridge/pending?${params.toString()}`;
-}
-function runPendingAuth(options) {
-  const { apiUrl, initialWorkspaceId, preferredBridgeName, onAuth } = options;
-  const logFn = options.log ?? log;
-  let ws = null;
-  let reconnectTimeout = null;
-  let keepaliveInterval = null;
-  let browserFallback = null;
-  const connectionId = crypto.randomUUID();
-  let hasOpenedBrowser = false;
-  let resolved = false;
-  let resolveAuth;
-  const authPromise = new Promise((resolve37) => {
-    resolveAuth = resolve37;
-  });
-  let reconnectAttempt = 0;
-  const signInQuiet = createEmptyReconnectQuietSlot();
-  function clearQuietOnOpen() {
-    clearReconnectQuietOnSuccessfulConnection(
-      signInQuiet,
-      logFn,
-      "[Bridge service] Sign-in connection restored."
-    );
-    reconnectAttempt = 0;
-  }
-  function beginDeferredPendingCloseLog(code, reason) {
+// src/auth/pending/pending-auth-on-close.ts
+function createPendingAuthOnClose(params) {
+  const { session, log: log2, connect } = params;
+  return (code, reason) => {
+    if (session.keepaliveInterval) {
+      clearInterval(session.keepaliveInterval);
+      session.keepaliveInterval = null;
+    }
+    if (session.resolved) return;
     beginDeferredDisconnectForReconnect({
-      isClosedByUser: () => resolved,
-      quiet: signInQuiet,
+      isClosedByUser: () => session.resolved,
+      quiet: session.signInQuiet,
       code,
       reason,
       willReconnect: true,
-      log: logFn,
+      log: log2,
       serviceLabel: "[Bridge service]",
       shutdownDetail: "Not reconnecting (shutting down).",
       reconnectingDetail: "Waiting for browser sign-in; reconnecting\u2026",
-      shouldAbortQuietWindow: () => ws != null && ws.readyState === wrapper_default.OPEN
+      shouldAbortQuietWindow: () => session.ws != null && session.ws.readyState === wrapper_default.OPEN
     });
-  }
-  function cleanup() {
-    clearReconnectQuietTimer(signInQuiet);
-    if (reconnectTimeout) {
-      clearTimeout(reconnectTimeout);
-      reconnectTimeout = null;
-    }
-    if (browserFallback) {
-      clearTimeout(browserFallback);
-      browserFallback = null;
-    }
-    if (keepaliveInterval) {
-      clearInterval(keepaliveInterval);
-      keepaliveInterval = null;
-    }
-    if (ws) {
-      const w = ws;
-      ws = null;
-      safeCloseWebSocket(w);
+    const delay4 = pendingAuthReconnectDelayMs(session.reconnectAttempt);
+    session.reconnectAttempt += 1;
+    if (session.signInQuiet.verboseLogs) {
+      const delayLabel = formatReconnectDelayForLog(delay4);
+      log2(
+        `[Bridge service] Next sign-in connection attempt in ${delayLabel} (attempt ${session.reconnectAttempt}).`
+      );
     }
+    session.reconnectTimeout = setTimeout(() => {
+      session.reconnectTimeout = null;
+      connect();
+    }, delay4);
+  };
+}
+
+// src/auth/pending/pending-auth-session.ts
+function createPendingAuthSession() {
+  let resolveAuth;
+  const authPromise = new Promise((resolve38) => {
+    resolveAuth = resolve38;
+  });
+  return {
+    ws: null,
+    reconnectTimeout: null,
+    keepaliveInterval: null,
+    browserFallback: null,
+    connectionId: crypto.randomUUID(),
+    hasOpenedBrowser: false,
+    resolved: false,
+    resolveAuth,
+    reconnectAttempt: 0,
+    signInQuiet: createEmptyReconnectQuietSlot(),
+    authPromise
+  };
+}
+function cleanupPendingAuthSession(session) {
+  clearReconnectQuietTimer(session.signInQuiet);
+  if (session.reconnectTimeout) {
+    clearTimeout(session.reconnectTimeout);
+    session.reconnectTimeout = null;
   }
-  function connect() {
-    const url2 = buildPendingBridgeUrl(apiUrl, connectionId);
-    let pendingHbSeq = -1;
-    ws = createWsBridge({
-      url: url2,
-      onOpen: () => {
-        clearQuietOnOpen();
-        pendingHbSeq = -1;
-        sendWsMessage(ws, { type: "identify", role: "cli", cliVersion: CLI_VERSION });
-        keepaliveInterval = setInterval(() => {
-          if (resolved || !ws || ws.readyState !== 1) return;
-          pendingHbSeq = pendingHbSeq >= BRIDGE_HEARTBEAT_SEQ_MAX ? 0 : pendingHbSeq + 1;
-          const hb = { t: "h", s: pendingHbSeq };
-          sendWsMessage(ws, hb);
-        }, PENDING_KEEPALIVE_MS);
-        if (browserFallback) {
-          clearTimeout(browserFallback);
-          browserFallback = null;
-        }
-        if (!hasOpenedBrowser) {
-          hasOpenedBrowser = true;
-          void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
-        }
-      },
-      onClose: (code, reason) => {
-        if (keepaliveInterval) {
-          clearInterval(keepaliveInterval);
-          keepaliveInterval = null;
-        }
-        if (resolved) return;
-        beginDeferredPendingCloseLog(code, reason);
-        const delay4 = pendingAuthReconnectDelayMs(reconnectAttempt);
-        reconnectAttempt += 1;
-        if (signInQuiet.verboseLogs) {
-          const delayLabel = formatReconnectDelayForLog(delay4);
-          logFn(
-            `[Bridge service] Next sign-in connection attempt in ${delayLabel} (attempt ${reconnectAttempt}).`
-          );
-        }
-        reconnectTimeout = setTimeout(() => {
-          reconnectTimeout = null;
-          connect();
-        }, delay4);
-      },
-      onError: (err) => logCliWebSocketError(logFn, "[Bridge service]", err, "while waiting for sign-in"),
-      onMessage: (data) => {
-        const msg = data;
-        if (msg.type === "auth_token" && typeof msg.token === "string") {
-          resolved = true;
-          const workspaceId = typeof msg.workspaceId === "string" ? msg.workspaceId : "";
-          cleanup();
-          const refreshToken = typeof msg.refreshToken === "string" ? msg.refreshToken : void 0;
-          const result = { workspaceId, token: msg.token, refreshToken };
-          resolveAuth(result);
-          onAuth(result);
-        }
-      }
-    });
+  if (session.browserFallback) {
+    clearTimeout(session.browserFallback);
+    session.browserFallback = null;
   }
-  browserFallback = setTimeout(() => {
-    browserFallback = null;
-    if (!hasOpenedBrowser) {
-      hasOpenedBrowser = true;
-      void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+  if (session.keepaliveInterval) {
+    clearInterval(session.keepaliveInterval);
+    session.keepaliveInterval = null;
+  }
+  if (session.ws) {
+    const w = session.ws;
+    session.ws = null;
+    safeCloseWebSocket(w);
+  }
+}
+
+// src/auth/pending/pending-auth-on-message.ts
+function createPendingAuthOnMessage(params) {
+  const { session, onAuth } = params;
+  return (data) => {
+    const msg = data;
+    if (msg.type !== "auth_token" || typeof msg.token !== "string") return;
+    session.resolved = true;
+    const workspaceId = typeof msg.workspaceId === "string" ? msg.workspaceId : "";
+    const refreshToken = typeof msg.refreshToken === "string" ? msg.refreshToken : void 0;
+    const result = { workspaceId, token: msg.token, refreshToken };
+    session.resolveAuth(result);
+    onAuth(result);
+    cleanupPendingAuthSession(session);
+  };
+}
+
+// src/auth/pending/pending-auth-on-open.ts
+function createPendingAuthOnOpen(params) {
+  const { session, apiUrl, initialWorkspaceId, preferredBridgeName, log: log2 } = params;
+  let pendingHbSeq = -1;
+  return () => {
+    clearReconnectQuietOnSuccessfulConnection(
+      session.signInQuiet,
+      log2,
+      "[Bridge service] Sign-in connection restored."
+    );
+    session.reconnectAttempt = 0;
+    pendingHbSeq = -1;
+    sendWsMessage(session.ws, { type: "identify", role: "cli", cliVersion: CLI_VERSION });
+    session.keepaliveInterval = setInterval(() => {
+      if (session.resolved || !session.ws || session.ws.readyState !== 1) return;
+      pendingHbSeq = pendingHbSeq >= BRIDGE_HEARTBEAT_SEQ_MAX ? 0 : pendingHbSeq + 1;
+      const hb = { t: "h", s: pendingHbSeq };
+      sendWsMessage(session.ws, hb);
+    }, PENDING_KEEPALIVE_MS);
+    if (session.browserFallback) {
+      clearTimeout(session.browserFallback);
+      session.browserFallback = null;
+    }
+    if (!session.hasOpenedBrowser) {
+      session.hasOpenedBrowser = true;
+      void openBrowser(session.connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, log2);
+    }
+  };
+}
+
+// src/auth/pending/connect-pending-auth.ts
+function connectPendingAuth(params) {
+  const { session, apiUrl, initialWorkspaceId, preferredBridgeName, onAuth, log: log2 } = params;
+  const connect = () => {
+    session.ws = createWsBridge({
+      url: buildPendingBridgeUrl(apiUrl, session.connectionId),
+      deferInboundMessages: false,
+      onOpen: createPendingAuthOnOpen({
+        session,
+        apiUrl,
+        initialWorkspaceId,
+        preferredBridgeName,
+        log: log2
+      }),
+      onClose: createPendingAuthOnClose({ session, log: log2, connect }),
+      onError: (err) => logCliWebSocketError(log2, "[Bridge service]", err, "while waiting for sign-in"),
+      onMessage: createPendingAuthOnMessage({ session, onAuth })
+    });
+  };
+  connect();
+}
+
+// src/auth/pending/run-pending-auth.ts
+function runPendingAuth(options) {
+  const { apiUrl, initialWorkspaceId, preferredBridgeName, onAuth } = options;
+  const logFn = options.log ?? log;
+  const session = createPendingAuthSession();
+  session.browserFallback = setTimeout(() => {
+    session.browserFallback = null;
+    if (!session.hasOpenedBrowser) {
+      session.hasOpenedBrowser = true;
+      void openBrowser(session.connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
     }
   }, BROWSER_OPEN_FALLBACK_MS);
-  connect();
+  connectPendingAuth({
+    session,
+    apiUrl,
+    initialWorkspaceId,
+    preferredBridgeName,
+    onAuth,
+    log: logFn
+  });
   return {
     close: () => {
-      if (!resolved) resolveAuth(null);
-      cleanup();
+      if (!session.resolved) session.resolveAuth(null);
+      cleanupPendingAuthSession(session);
     },
-    authPromise
+    authPromise: session.authPromise
   };
 }
 
@@ -35183,10 +35246,10 @@ async function killChildProcessTreeGracefully(child, graceMs = ACP_PROCESS_TREE_
   }
   await killProcessTree(pid, "SIGTERM");
   if (graceMs <= 0) return;
-  const exited = new Promise((resolve37) => {
-    child.once("exit", () => resolve37());
+  const exited = new Promise((resolve38) => {
+    child.once("exit", () => resolve38());
   });
-  await Promise.race([exited, new Promise((resolve37) => setTimeout(resolve37, graceMs))]);
+  await Promise.race([exited, new Promise((resolve38) => setTimeout(resolve38, graceMs))]);
   if (child.exitCode == null && child.signalCode == null) {
     await killProcessTree(pid, "SIGKILL");
   }
@@ -35203,8 +35266,8 @@ async function gracefulAcpSubprocessDisconnect(params) {
       await transport.closeSession?.(sessionId);
     } catch {
     }
-    await new Promise((resolve37) => {
-      const timer = setTimeout(resolve37, ACP_GRACEFUL_SESSION_CLOSE_WAIT_MS);
+    await new Promise((resolve38) => {
+      const timer = setTimeout(resolve38, ACP_GRACEFUL_SESSION_CLOSE_WAIT_MS);
       timer.unref?.();
     });
   }
@@ -35479,11 +35542,11 @@ function createSdkStdioExtNotificationHandler(options) {
 // src/agents/acp/clients/sdk/sdk-stdio-permission-request-handshake.ts
 function awaitSdkStdioPermissionRequestHandshake(params) {
   const { requestId, paramsRecord, pending: pending2, onRequest } = params;
-  return new Promise((resolve37) => {
-    pending2.set(requestId, { resolve: resolve37, params: paramsRecord });
+  return new Promise((resolve38) => {
+    pending2.set(requestId, { resolve: resolve38, params: paramsRecord });
     if (onRequest == null) {
       pending2.delete(requestId);
-      resolve37({ outcome: { outcome: "denied" } });
+      resolve38({ outcome: { outcome: "denied" } });
       return;
     }
     try {
@@ -35995,10 +36058,10 @@ function createSdkStdioInitSettle(child) {
       forceAcpSubprocessDisconnect(child);
       reject(err);
     },
-    settleResolve(resolve37, handle) {
+    settleResolve(resolve38, handle) {
       if (initSettled) return;
       initSettled = true;
-      resolve37(handle);
+      resolve38(handle);
     }
   };
 }
@@ -36087,7 +36150,7 @@ async function createSdkStdioAcpClient(options) {
     onFileChange,
     stderrCapture
   });
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const init = createSdkStdioInitSettle(child);
     child.on("error", (err) => {
       init.settleReject(reject, new Error(formatSpawnError(err, command[0])));
@@ -36112,7 +36175,7 @@ async function createSdkStdioAcpClient(options) {
           protocolVersion: PROTOCOL_VERSION2
         });
         init.settleResolve(
-          resolve37,
+          resolve38,
           createSdkStdioHandle({
             child,
             sessionId: established.sessionId,
@@ -36693,7 +36756,7 @@ async function createCursorAcpClient(options) {
     onFileChange,
     stderrCapture
   });
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     child.on("error", (err) => {
       killChildProcessTree(child, "SIGKILL");
       reject(new Error(formatSpawnError(err, command[0])));
@@ -36706,7 +36769,7 @@ async function createCursorAcpClient(options) {
           skipBrowserAuthenticate,
           incomingDeps: { dbgFs, sessionCtx, onSessionUpdate, onRequest }
         });
-        resolve37(
+        resolve38(
           createCursorAcpHandle({
             child,
             sessionId: established.sessionId,
@@ -38145,8 +38208,8 @@ async function runGitTask(fn) {
 }
 async function yieldToEventLoop2() {
   throwIfGitShutdownRequested();
-  await new Promise((resolve37) => {
-    setImmediate(resolve37);
+  await new Promise((resolve38) => {
+    setImmediate(resolve38);
   });
   throwIfGitShutdownRequested();
 }
@@ -38183,8 +38246,8 @@ async function execGitFile(args, options) {
 }
 
 // src/git/changes/parse/normalize-git-diff-path.ts
-function normalizeGitDiffPath(path86) {
-  return path86.replace(/\\/g, "/").replace(/\/ +/g, "/").trim();
+function normalizeGitDiffPath(path88) {
+  return path88.replace(/\\/g, "/").replace(/\/ +/g, "/").trim();
 }
 
 // src/git/changes/parse/parse-name-status-entries.ts
@@ -39502,11 +39565,11 @@ function isServerNotRunningError(err) {
 }
 function closeHttpServer(server) {
   if (!server) return Promise.resolve();
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     server.close((err) => {
       if (err && !isServerNotRunningError(err)) {
       }
-      resolve37();
+      resolve38();
     });
   });
 }
@@ -39519,7 +39582,7 @@ var RequestBodyTooLargeError = class extends Error {
   }
 };
 function readJsonBody(req) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const chunks = [];
     let total = 0;
     let tooLarge = false;
@@ -39539,11 +39602,11 @@ function readJsonBody(req) {
       try {
         const raw = Buffer.concat(chunks).toString("utf8").trim();
         if (!raw) {
-          resolve37({});
+          resolve38({});
           return;
         }
         const parsed = JSON.parse(raw);
-        resolve37(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
+        resolve38(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
       } catch (e) {
         reject(e);
       }
@@ -39601,7 +39664,7 @@ function createBridgeAccessRequestHandler(registry2) {
 // src/mcp/bridge-access/start-server.ts
 function startBridgeAccessServer(registry2) {
   const server = http.createServer(createBridgeAccessRequestHandler(registry2));
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
@@ -39609,7 +39672,7 @@ function startBridgeAccessServer(registry2) {
         reject(new Error("Bridge access server did not bind"));
         return;
       }
-      resolve37({
+      resolve38({
         port: addr.port,
         close: () => closeHttpServer(server)
       });
@@ -41248,19 +41311,19 @@ function buildLocalHttpRequestOptions(built) {
 }
 function runLocalHttpRequestOnce(mod, built) {
   const opts = buildLocalHttpRequestOptions(built);
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     const req = mod.request(opts, (res) => {
       const chunks = [];
       res.on("data", (chunk) => chunks.push(chunk));
       res.on("end", () => {
-        resolve37({
+        resolve38({
           statusCode: res.statusCode ?? 0,
           headers: incomingMessageHeaders(res),
           body: Buffer.concat(chunks)
         });
       });
       res.on("error", (err) => {
-        resolve37({
+        resolve38({
           statusCode: 0,
           headers: {},
           body: Buffer.alloc(0),
@@ -41272,7 +41335,7 @@ function runLocalHttpRequestOnce(mod, built) {
       req.destroy(new Error(`Local preview request timed out after ${LOCAL_PROXY_REQUEST_TIMEOUT_MS}ms`));
     });
     req.on("error", (err) => {
-      resolve37({
+      resolve38({
         statusCode: 0,
         headers: {},
         body: Buffer.alloc(0),
@@ -41296,14 +41359,14 @@ async function proxyToLocalStreaming(request, callbacks) {
   const isHttps = request.url.startsWith("https:");
   const mod = await loadHttpModule(isHttps);
   const opts = buildLocalHttpRequestOptions(built);
-  await new Promise((resolve37) => {
+  await new Promise((resolve38) => {
     const req = mod.request(opts, (res) => {
       try {
         callbacks.onStart(res.statusCode ?? 0, incomingMessageHeaders(res));
       } catch (err) {
         req.destroy();
         callbacks.onError(err instanceof Error ? err.message : String(err));
-        resolve37();
+        resolve38();
         return;
       }
       res.on("data", (chunk) => {
@@ -41316,11 +41379,11 @@ async function proxyToLocalStreaming(request, callbacks) {
       });
       res.on("end", () => {
         callbacks.onEnd();
-        resolve37();
+        resolve38();
       });
       res.on("error", (err) => {
         callbacks.onError(err.message);
-        resolve37();
+        resolve38();
       });
     });
     req.setTimeout(LOCAL_PROXY_REQUEST_TIMEOUT_MS, () => {
@@ -41328,7 +41391,7 @@ async function proxyToLocalStreaming(request, callbacks) {
     });
     req.on("error", (err) => {
       callbacks.onError(err.message);
-      resolve37();
+      resolve38();
     });
     if (built.sendingBody && built.body != null) {
       req.write(built.body);
@@ -42452,8 +42515,8 @@ function pathspec(...paths) {
   cache.set(key, paths);
   return key;
 }
-function isPathSpec(path86) {
-  return path86 instanceof String && cache.has(path86);
+function isPathSpec(path88) {
+  return path88 instanceof String && cache.has(path88);
 }
 function toPaths(pathSpec) {
   return cache.get(pathSpec) || [];
@@ -42542,8 +42605,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path86) {
-  return (0, import_file_exists.exists)(path86, import_file_exists.FOLDER);
+function folderExists(path88) {
+  return (0, import_file_exists.exists)(path88, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -42947,8 +43010,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path86) {
-      return /^\.(git)?$/.test(path86.trim());
+    parser(path88) {
+      return /^\.(git)?$/.test(path88.trim());
     }
   };
 }
@@ -43382,11 +43445,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path86, line, preview] = input.split(NULL);
-    paths.add(path86);
-    (results[path86] = results[path86] || []).push({
+    const [path88, line, preview] = input.split(NULL);
+    paths.add(path88);
+    (results[path88] = results[path88] || []).push({
       line: asNumber(line),
-      path: path86,
+      path: path88,
       preview
     });
   });
@@ -44151,14 +44214,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path86, text) {
+function parseInit(bare, path88, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path86, false, result[1]);
+    return new InitSummary(bare, path88, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path86, true, result[1]);
+    return new InitSummary(bare, path88, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -44169,7 +44232,7 @@ function parseInit(bare, path86, text) {
       break;
     }
   }
-  return new InitSummary(bare, path86, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path88, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -44178,9 +44241,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path86, existing, gitDir) {
+      constructor(bare, path88, existing, gitDir) {
         this.bare = bare;
-        this.path = path86;
+        this.path = path88;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -44192,7 +44255,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path86, customArgs) {
+function initTask(bare = false, path88, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -44201,7 +44264,7 @@ function initTask(bare = false, path86, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path86, text);
+      return parseInit(commands.includes("--bare"), path88, text);
     }
   };
 }
@@ -45017,12 +45080,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path86, index, working_dir) {
-        this.path = path86;
+      constructor(path88, index, working_dir) {
+        this.path = path88;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path86) || [null, path86, path86];
+          const detail = fromPathRegex.exec(path88) || [null, path88, path88];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -45053,14 +45116,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path86) {
+  function data(index, workingDir, path88) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path86);
+      handler(result, path88);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path86, index, workingDir));
+      result.files.push(new FileStatusSummary(path88, index, workingDir));
     }
   }
 }
@@ -45369,9 +45432,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path86, write) {
+      hashObject(path88, write) {
         return this._runTask(
-          hashObjectTask(path86, write === true),
+          hashObjectTask(path88, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -45724,8 +45787,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path86 = input.trim().replace(/^["']|["']$/g, "");
-  return path86 && normalize3(path86);
+  const path88 = input.trim().replace(/^["']|["']$/g, "");
+  return path88 && normalize3(path88);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -46039,8 +46102,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path86) {
-  return subModuleTask(["add", repo, path86]);
+function addSubModuleTask(repo, path88) {
+  return subModuleTask(["add", repo, path88]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -46373,8 +46436,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path86, then) {
-      return this._runTask(addSubModuleTask2(repo, path86), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path88, then) {
+      return this._runTask(addSubModuleTask2(repo, path88), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -47113,8 +47176,8 @@ function parseNumstatEntries(lines) {
 }
 function parseNumstat(lines) {
   const m = /* @__PURE__ */ new Map();
-  for (const [path86, entry] of parseNumstatEntries(lines)) {
-    m.set(path86, { additions: entry.additions, deletions: entry.deletions });
+  for (const [path88, entry] of parseNumstatEntries(lines)) {
+    m.set(path88, { additions: entry.additions, deletions: entry.deletions });
   }
   return m;
 }
@@ -51202,7 +51265,7 @@ init_symbol_index_file_ready();
 var CODE_NAV_INDEX_READY_WAIT_MS = 75;
 var CODE_NAV_INDEX_READY_POLL_MS = 15;
 function delay2(ms) {
-  return new Promise((resolve37) => setTimeout(resolve37, ms));
+  return new Promise((resolve38) => setTimeout(resolve38, ms));
 }
 async function waitForSymbolIndexReady(sessionParentPath, reqPath, maxWaitMs = CODE_NAV_INDEX_READY_WAIT_MS) {
   const deadline = Date.now() + maxWaitMs;
@@ -51334,12 +51397,12 @@ function parseOptionalInt2(raw) {
   return Number.isInteger(parsed) ? parsed : void 0;
 }
 function parseCodeNavParams(url2) {
-  const path86 = url2.searchParams.get("path") ?? "";
+  const path88 = url2.searchParams.get("path") ?? "";
   const opRaw = url2.searchParams.get("op")?.trim();
   const op = opRaw === "references" ? "references" : opRaw === "symbols" ? "symbols" : opRaw === "definitions" ? "definitions" : "definition";
   const line = parseOptionalInt2(url2.searchParams.get("line")) ?? 1;
   const column = parseOptionalInt2(url2.searchParams.get("column")) ?? 0;
-  return { path: path86, op, line, column };
+  return { path: path88, op, line, column };
 }
 function parseCodeNavPath(url2) {
   const raw = url2.searchParams.get("path")?.trim();
@@ -51515,7 +51578,7 @@ function createLocalShortcutRequestHandler(ctx) {
 var RESTART_DELAY_MS = 250;
 var MAX_RESTART_ATTEMPTS = 5;
 function listenOnPort(server, port) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     server.once("error", reject);
     server.listen(port, "127.0.0.1", () => {
       const addr = server.address();
@@ -51523,12 +51586,12 @@ function listenOnPort(server, port) {
         reject(new Error("Local shortcut server did not bind"));
         return;
       }
-      resolve37(addr.port);
+      resolve38(addr.port);
     });
   });
 }
 function delay3(ms) {
-  return new Promise((resolve37) => setTimeout(resolve37, ms));
+  return new Promise((resolve38) => setTimeout(resolve38, ms));
 }
 function startLocalShortcutServer(ctx) {
   let closed = false;
@@ -51728,7 +51791,8 @@ var API_TO_BRIDGE_MESSAGE_TYPES = [
   "install_agent",
   "refresh_local_skills",
   "bridge_git_context_request",
-  "list_repo_branches_request"
+  "list_repo_branches_request",
+  "bridge_git_checkout_request"
 ];
 var API_TO_BRIDGE_TYPE_SET = new Set(API_TO_BRIDGE_MESSAGE_TYPES);
 function parseApiToBridgeMessage(data, log2) {
@@ -52421,10 +52485,10 @@ async function awaitGitStatePreparation(options) {
   try {
     return await Promise.race([
       work,
-      new Promise((resolve37) => {
+      new Promise((resolve38) => {
         timer = setTimeout(() => {
           log2(`[Agent] ${label} exceeded ${timeoutMs}ms; continuing without it.`);
-          resolve37(fallback);
+          resolve38(fallback);
         }, timeoutMs);
         timer.unref?.();
       })
@@ -52987,8 +53051,8 @@ function randomSecret() {
   }
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-async function requestPreviewApi(port, secret, method, path86, body) {
-  const url2 = `http://127.0.0.1:${port}${path86}`;
+async function requestPreviewApi(port, secret, method, path88, body) {
+  const url2 = `http://127.0.0.1:${port}${path88}`;
   const headers = {
     [PREVIEW_SECRET_HEADER]: secret,
     "Content-Type": "application/json"
@@ -53000,7 +53064,7 @@ async function requestPreviewApi(port, secret, method, path86, body) {
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    throw new Error(data?.error ?? `Preview API ${method} ${path86}: ${res.status}`);
+    throw new Error(data?.error ?? `Preview API ${method} ${path88}: ${res.status}`);
   }
   return data;
 }
@@ -53257,7 +53321,7 @@ var handleInstallSkillsMessage = (msg, deps) => {
 import { spawn as spawn11 } from "node:child_process";
 import * as readline3 from "node:readline";
 function runStreamingCommand(command, args, options) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const child = spawn11(command, args, {
       env: options.env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -53290,7 +53354,7 @@ function runStreamingCommand(command, args, options) {
       if (timer) clearTimeout(timer);
       if (!settled) {
         settled = true;
-        resolve37({ code, signal });
+        resolve38({ code, signal });
       }
     });
   });
@@ -53729,6 +53793,23 @@ async function listRepoBranchRefs(repoPath) {
   }
 }
 
+// src/git/checkout/pending-checkouts.ts
+var pendingByRelPath = /* @__PURE__ */ new Map();
+function beginPendingCheckout(row) {
+  const relPath = row.relPath.trim() || ".";
+  pendingByRelPath.set(relPath, {
+    relPath,
+    folderName: row.folderName.trim() || (relPath === "." ? "repo" : relPath),
+    remoteUrl: row.remoteUrl
+  });
+}
+function endPendingCheckout(relPath) {
+  pendingByRelPath.delete(relPath.trim() || ".");
+}
+function listPendingCheckouts() {
+  return [...pendingByRelPath.values()];
+}
+
 // src/git/bridge-git-context.ts
 function folderNameForRelPath(relPath, bridgeRoot) {
   if (relPath === "." || relPath === "") {
@@ -53765,7 +53846,23 @@ async function getBridgeGitContext(bridgeRoot = getBridgeRoot()) {
       relPath,
       folderName: folderNameForRelPath(relPath, bridgeResolved),
       currentBranch,
-      remoteUrl
+      remoteUrl,
+      cloning: false
+    });
+  }
+  const seen = new Set(rows.map((r) => r.relPath));
+  for (const pending2 of listPendingCheckouts()) {
+    if (seen.has(pending2.relPath)) {
+      const row = rows.find((r) => r.relPath === pending2.relPath);
+      if (row) row.cloning = true;
+      continue;
+    }
+    rows.push({
+      relPath: pending2.relPath,
+      folderName: pending2.folderName,
+      currentBranch: null,
+      remoteUrl: pending2.remoteUrl,
+      cloning: true
     });
   }
   rows.sort((a, b) => a.relPath.localeCompare(b.relPath));
@@ -53825,6 +53922,143 @@ function handleListRepoBranchesRequestMessage(msg, getWs) {
   })();
 }
 
+// src/git/checkout/bridge-git-checkout.ts
+import * as fs65 from "node:fs/promises";
+import * as path86 from "node:path";
+
+// src/git/checkout/normalize-clone-url.ts
+function normalizeCloneUrl(url2) {
+  const u = url2.trim();
+  if (!u.startsWith("http://") && !u.startsWith("https://")) {
+    throw new Error("Only http(s) git remote URLs are supported");
+  }
+  return u.endsWith(".git") ? u : `${u}.git`;
+}
+function cloneUrlWithHttpsAuth(url2, auth) {
+  const normalized = normalizeCloneUrl(url2);
+  if (!auth) return normalized;
+  const parsed = new URL(normalized);
+  parsed.username = auth.username;
+  parsed.password = auth.password;
+  return parsed.toString();
+}
+
+// src/git/checkout/resolve-checkout-target.ts
+import * as fs64 from "node:fs/promises";
+import * as path85 from "node:path";
+var FOLDER_NAME_RE = /^[A-Za-z0-9._-]+$/;
+async function pathExists(p) {
+  try {
+    await fs64.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveCheckoutTarget(opts) {
+  const bridgeRoot = getBridgeRoot();
+  if (opts.layout === "monorepo") {
+    if (await isGitRepoDirectory(bridgeRoot)) {
+      throw new Error("Bridge root is already a git repository");
+    }
+    const entries = await fs64.readdir(bridgeRoot).catch(() => []);
+    if (entries.length > 0) {
+      throw new Error("Bridge root must be empty to initialize a monorepo checkout");
+    }
+    return { targetDir: bridgeRoot, relPath: "." };
+  }
+  const folder = (opts.folderName ?? "").trim();
+  if (!folder || folder === "." || folder === ".." || !FOLDER_NAME_RE.test(folder)) {
+    throw new Error("folderName must be a single path segment (letters, numbers, . _ -)");
+  }
+  if (await isGitRepoDirectory(bridgeRoot)) {
+    throw new Error("Cannot add a nested repo while the bridge root is itself a git repository");
+  }
+  const targetDir = path85.resolve(bridgeRoot, folder);
+  if (!targetDir.startsWith(bridgeRoot + path85.sep)) {
+    throw new Error("Invalid folderName");
+  }
+  if (await pathExists(targetDir)) {
+    throw new Error(`Folder already exists: ${folder}`);
+  }
+  return { targetDir, relPath: folder };
+}
+
+// src/git/checkout/bridge-git-checkout.ts
+async function bridgeGitCheckout(params) {
+  const cloneUrl = (params.cloneUrl ?? "").trim();
+  if (!cloneUrl) throw new Error("cloneUrl required");
+  const { targetDir, relPath } = await resolveCheckoutTarget({
+    layout: params.layout,
+    folderName: params.folderName
+  });
+  const folderName = relPath === "." ? "repo" : relPath;
+  beginPendingCheckout({ relPath, folderName, remoteUrl: cloneUrl });
+  const parent = path86.dirname(targetDir);
+  await fs65.mkdir(parent, { recursive: true });
+  if (relPath !== ".") {
+    await fs65.mkdir(targetDir, { recursive: true });
+  }
+  const url2 = cloneUrlWithHttpsAuth(cloneUrl, params.auth ?? null);
+  try {
+    await execGitFile(["clone", "--", url2, targetDir], {
+      cwd: parent,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    });
+    return { relPath, folderName };
+  } catch (e) {
+    if (relPath !== ".") {
+      await fs65.rm(targetDir, { recursive: true, force: true }).catch(() => void 0);
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    throw new Error(
+      msg.includes("Authentication") || msg.includes("403") || msg.includes("401") ? `Clone failed (auth?): ${msg}` : `Clone failed: ${msg}`
+    );
+  } finally {
+    endPendingCheckout(relPath);
+  }
+}
+
+// src/routing/handlers/bridge-git-checkout-messages.ts
+function handleBridgeGitCheckoutRequestMessage(msg, getWs) {
+  void (async () => {
+    const socket = getWs();
+    if (!socket) return;
+    const layout = msg.layout === "multi_repo" ? "multi_repo" : msg.layout === "monorepo" ? "monorepo" : null;
+    if (!layout) {
+      sendWsMessage(socket, {
+        type: "bridge_git_checkout_response",
+        id: msg.id,
+        error: "layout must be monorepo or multi_repo"
+      });
+      return;
+    }
+    try {
+      const user = typeof msg.authUsername === "string" ? msg.authUsername : "";
+      const pass = typeof msg.authPassword === "string" ? msg.authPassword : "";
+      const result = await bridgeGitCheckout({
+        layout,
+        folderName: msg.folderName,
+        cloneUrl: msg.cloneUrl ?? "",
+        auth: user && pass ? { username: user, password: pass } : null
+      });
+      sendWsMessage(socket, {
+        type: "bridge_git_checkout_response",
+        id: msg.id,
+        ok: true,
+        relPath: result.relPath,
+        folderName: result.folderName
+      });
+    } catch (e) {
+      sendWsMessage(socket, {
+        type: "bridge_git_checkout_response",
+        id: msg.id,
+        error: e instanceof Error ? e.message : String(e)
+      });
+    }
+  })();
+}
+
 // src/routing/dispatch/file-browser.ts
 function dispatchBridgeFileBrowserMessage(msg, deps) {
   switch (msg.type) {
@@ -53843,6 +54077,9 @@ function dispatchBridgeFileBrowserMessage(msg, deps) {
     case "list_repo_branches_request":
       handleListRepoBranchesRequestMessage(msg, deps.getWs);
       break;
+    case "bridge_git_checkout_request":
+      handleBridgeGitCheckoutRequestMessage(msg, deps.getWs);
+      break;
   }
 }
 
@@ -53883,6 +54120,7 @@ function dispatchBridgeMessage(msg, deps) {
     case "code_nav":
     case "bridge_git_context_request":
     case "list_repo_branches_request":
+    case "bridge_git_checkout_request":
       dispatchBridgeFileBrowserMessage(msg, deps);
       break;
   }
@@ -54266,32 +54504,42 @@ async function openE2eCertificateImportUrl({
   }
 }
 
-// src/run-bridge-connected.ts
+// src/run-bridge-e2ee-key-command.ts
+function installConnectedBridgeE2eeKeyCommand(params) {
+  let openingCertificate = false;
+  return installE2eCertificateKeyCommand({
+    log: params.log,
+    onInterrupt: params.onInterrupt,
+    onOpenCertificate: () => {
+      if (openingCertificate) return;
+      openingCertificate = true;
+      void openE2eCertificateImportUrl({
+        apiUrl: params.apiUrl,
+        workspaceId: params.workspaceId,
+        certificate: params.e2eCertificate,
+        log: params.log
+      }).finally(() => {
+        openingCertificate = false;
+      });
+    }
+  });
+}
+
+// src/run-bridge-connected-signals.ts
+init_log();
 init_cli_process_interrupt();
-init_cli_database();
-async function runConnectedBridge(options, restartWithoutAuth) {
-  const {
-    apiUrl,
-    workspaceId,
-    authToken,
-    refreshToken,
-    justAuthenticated,
-    worktreesRootPath,
-    e2eCertificate
-  } = options;
-  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
-  let cleanupKeyCommand;
-  let bridgeClose = null;
+function installConnectedBridgeSignals(params) {
   let shutdownStarted = false;
   const onSignal = (kind) => {
     requestCliImmediateShutdown();
     abortActiveGitChildProcesses();
-    cleanupKeyCommand?.();
+    params.cleanupKeyCommand();
     if (shutdownStarted) return;
     shutdownStarted = true;
     logImmediate(
       kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
     );
+    const bridgeClose = params.getBridgeClose();
     if (bridgeClose) {
       void bridgeClose().finally(() => process.exit(0));
       return;
@@ -54302,9 +54550,56 @@ async function runConnectedBridge(options, restartWithoutAuth) {
   const onSigTerm = () => onSignal("stop");
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
-  let handle;
+  return {
+    onSigInt,
+    remove: () => {
+      process.off("SIGINT", onSigInt);
+      process.off("SIGTERM", onSigTerm);
+    }
+  };
+}
+
+// src/run-bridge-on-auth-invalid.ts
+init_cli_process_interrupt();
+async function closeBridgeForReauth(params) {
+  params.log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
+  clearConfigForApi(params.apiUrl);
+  await params.close();
+  params.removeSignalHandlers();
+  await clearCliImmediateShutdown();
+  params.endConnectedSession();
+}
+
+// src/run-bridge-connected.ts
+init_cli_database();
+async function runConnectedBridge(options, restartWithoutAuth) {
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    justAuthenticated,
+    worktreesRootPath,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  let cleanupKeyCommand;
+  let bridgeClose = null;
+  let endConnectedSession;
+  const sessionDone = new Promise((resolve38) => {
+    endConnectedSession = resolve38;
+  });
+  let resolveHandleReady;
+  const handleReady = new Promise((resolve38) => {
+    resolveHandleReady = resolve38;
+  });
+  const handleRef = { current: null };
+  const signals = installConnectedBridgeSignals({
+    getBridgeClose: () => bridgeClose,
+    cleanupKeyCommand: () => cleanupKeyCommand?.()
+  });
   try {
-    handle = await createBridgeConnection({
+    const handle = await createBridgeConnection({
       apiUrl,
       workspaceId,
       authToken,
@@ -54323,41 +54618,40 @@ async function runConnectedBridge(options, restartWithoutAuth) {
       },
       onAuthInvalid: () => {
         cleanupKeyCommand?.();
-        log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
-        clearConfigForApi(apiUrl);
-        void handle.close().then(() => {
-          void restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootPath, e2eCertificate });
-        });
+        void (async () => {
+          await handleReady;
+          await closeBridgeForReauth({
+            apiUrl,
+            log,
+            close: async () => {
+              if (handleRef.current) await handleRef.current.close();
+            },
+            removeSignalHandlers: signals.remove,
+            endConnectedSession
+          });
+        })();
       }
     });
-  } catch (e) {
-    process.off("SIGINT", onSigInt);
-    process.off("SIGTERM", onSigTerm);
-    if (e instanceof CliSqliteInterrupted) {
-      process.exit(0);
+    handleRef.current = handle;
+    bridgeClose = () => handle.close();
+    if (e2eCertificate) {
+      cleanupKeyCommand = installConnectedBridgeE2eeKeyCommand({
+        apiUrl,
+        workspaceId,
+        e2eCertificate,
+        log,
+        onInterrupt: signals.onSigInt
+      });
     }
+  } catch (e) {
+    signals.remove();
+    if (e instanceof CliSqliteInterrupted) process.exit(0);
     throw e;
+  } finally {
+    resolveHandleReady();
   }
-  bridgeClose = () => handle.close();
-  if (e2eCertificate) {
-    let openingCertificate = false;
-    cleanupKeyCommand = installE2eCertificateKeyCommand({
-      log,
-      onInterrupt: onSigInt,
-      onOpenCertificate: () => {
-        if (openingCertificate) return;
-        openingCertificate = true;
-        void openE2eCertificateImportUrl({
-          apiUrl,
-          workspaceId,
-          certificate: e2eCertificate,
-          log
-        }).finally(() => {
-          openingCertificate = false;
-        });
-      }
-    });
-  }
+  await sessionDone;
+  await restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootPath, e2eCertificate });
 }
 
 // src/run-bridge.ts
@@ -54401,12 +54695,16 @@ async function runBridge(options) {
     process.off("SIGINT", onSigInt);
     process.off("SIGTERM", onSigTerm);
     handle.close();
-    if (!auth) return;
+    if (!auth) {
+      log("Sign-in ended before a token was received.");
+      return;
+    }
     writeConfigForApi(apiUrl, {
       workspaceId: auth.workspaceId,
       token: auth.token,
       refreshToken: auth.refreshToken
     });
+    log("Link established. Connecting with the new token\u2026");
     await runBridge({
       apiUrl,
       workspaceId: auth.workspaceId,
@@ -54444,9 +54742,9 @@ async function runCliAction(program2, opts) {
   const firehoseServerUrl = opts.firehoseUrl ?? opts.proxyUrl ?? process.env.BUILDAUTOMATON_FIREHOSE_URL ?? process.env.BUILDAUTOMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL;
   const bridgeRootOpt = (opts.bridgeRoot && typeof opts.bridgeRoot === "string" && opts.bridgeRoot.trim() ? opts.bridgeRoot.trim() : null) ?? (opts.cwd && typeof opts.cwd === "string" && opts.cwd.trim() ? opts.cwd.trim() : null);
   if (bridgeRootOpt) {
-    const resolvedBridgeRoot = path85.resolve(process.cwd(), bridgeRootOpt);
+    const resolvedBridgeRoot = path87.resolve(process.cwd(), bridgeRootOpt);
     try {
-      const st = fs64.statSync(resolvedBridgeRoot);
+      const st = fs66.statSync(resolvedBridgeRoot);
       if (!st.isDirectory()) {
         console.error(`Bridge root is not a directory: ${resolvedBridgeRoot}`);
         process.exit(1);
@@ -54466,7 +54764,7 @@ async function runCliAction(program2, opts) {
   );
   let worktreesRootPath;
   if (opts.worktreesRoot && opts.worktreesRoot.trim()) {
-    worktreesRootPath = path85.resolve(opts.worktreesRoot.trim());
+    worktreesRootPath = path87.resolve(opts.worktreesRoot.trim());
   }
   const e2eCertificates = opts.e2eeCertificatesDir?.trim() ? await loadOrCreateE2eCertificates(opts.e2eeCertificatesDir.trim()) : void 0;
   if (e2eCertificates) {