@fabricorg/cli 0.5.1 → 0.6.0

package/dist/fabric.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/bin/fabric.ts
-import { Command as Command21 } from "commander";
+import { Command as Command22 } from "commander";
 
 // package.json
 var package_default = {
   name: "@fabricorg/cli",
-  version: "0.5.1",
+  version: "0.6.0",
   description: "CLI for the Fabric AI platform",
   keywords: [
     "fabric",
@@ -38,7 +38,7 @@ var package_default = {
     build: "tsup",
     dev: "tsup --watch",
     "pack:deployment": "node scripts/pack-deployment.mjs",
-    "type-check": "tsc --noEmit",
+    "type-check": "tsgo --noEmit",
     test: "vitest run",
     "test:watch": "vitest",
     fabric: "node --import tsx/esm src/bin/fabric.ts"
@@ -847,6 +847,32 @@ var InstructionsResource = class {
       `/projects/${encodeURIComponent(projectId)}/instructions/published${buildQuery3(options)}`
     );
   }
+  /**
+   * The credential-free metadata for a repository that Fabric reads directly.
+   * It resolves the configured branch once but never creates a snapshot,
+   * manifest, archive or provider write.
+   */
+  getRepositoryState(projectId, options = {}) {
+    return this.http.get(
+      `/projects/${encodeURIComponent(projectId)}/instructions/repository${buildQuery3(options)}`
+    );
+  }
+  /**
+   * Bounded repository metadata at one commit. The first call returns the
+   * commit pin; repeat calls must carry that pin so a moving branch cannot
+   * mix tree metadata with later file bytes.
+   */
+  listRepositoryFiles(projectId, options = {}) {
+    return this.http.get(
+      `/projects/${encodeURIComponent(projectId)}/instructions/repository/files${buildQuery3(options)}`
+    );
+  }
+  /** Read one text file from an already pinned direct repository commit. */
+  getRepositoryFile(projectId, options) {
+    return this.http.get(
+      `/projects/${encodeURIComponent(projectId)}/instructions/repository/file${buildQuery3(options)}`
+    );
+  }
   /**
    * Which projects use the repository a checkout was cloned from.
    *
@@ -947,6 +973,13 @@ var InstructionsResource = class {
    * against the five-per-proposer cap. The `snapshotId` a retry returns is
    * therefore the same `snapshotId`.
    */
+  submitRepositoryChange(projectId, nativeBase, changes, options = {}) {
+    const { note, ...context } = options;
+    return this.http.post(
+      `/projects/${encodeURIComponent(projectId)}/instructions/changes${buildQuery3(context)}`,
+      { nativeBase, changes, ...note ? { note } : {} }
+    );
+  }
   submitChange(projectId, baseSnapshotId, changes, options = {}) {
     const { note, ...context } = options;
     return this.http.post(
@@ -2368,12 +2401,13 @@ var CALLBACK_PATH = "/callback";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
 var PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem"><h1 style="font-weight:400">${title}</h1><p>${body}</p></body>`;
 async function startLoopbackListener(options) {
+  const callbackPath = options.callbackPath ?? CALLBACK_PATH;
   let settle = () => {
   };
   const result = new Promise((resolve, reject) => {
     settle = (outcome) => {
       if ("code" in outcome) {
-        resolve({ code: outcome.code });
+        resolve(outcome);
       } else {
         reject(outcome.error);
       }
@@ -2383,13 +2417,13 @@ async function startLoopbackListener(options) {
   });
   const server = createServer((request, response) => {
     const url = new URL(request.url ?? "/", "http://127.0.0.1");
-    if (request.method !== "GET" || url.pathname !== CALLBACK_PATH) {
+    if (request.method !== "GET" || url.pathname !== callbackPath) {
       response.writeHead(404).end();
       return;
     }
     const error = url.searchParams.get("error");
     const state = url.searchParams.get("state");
-    const code = url.searchParams.get("code");
+    const code = url.searchParams.get(options.codeParam ?? "code");
     if (state !== options.state) {
       response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(
         PAGE(
@@ -2428,12 +2462,20 @@ async function startLoopbackListener(options) {
         "You can close this tab and return to your terminal."
       )
     );
-    settle({ code });
+    settle({ code, params: url.searchParams });
   });
-  await new Promise((resolve, reject) => {
+  const listen = (port2) => new Promise((resolve, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolve());
+    server.listen(port2, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
   });
+  if (options.preferredPort === void 0) {
+    await listen(0);
+  } else {
+    await listen(options.preferredPort).catch(() => listen(0));
+  }
   const { port } = server.address();
   const timer = setTimeout(
     () => settle({
@@ -2451,7 +2493,7 @@ async function startLoopbackListener(options) {
   };
   result.then(close, close);
   return {
-    redirectUri: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+    redirectUri: `http://127.0.0.1:${port}${callbackPath}`,
     result,
     close
   };
@@ -2501,6 +2543,7 @@ var REQUESTED_SCOPES = [
   "instructions:write",
   "offline_access"
 ];
+var REPOSITORY_TRANSPORT_SCOPE = "repositories:read";
 var CLIENT_NAME = "Fabric CLI";
 var UNUSABLE_CLIENT_ERRORS = /* @__PURE__ */ new Set([
   "invalid_client",
@@ -2542,7 +2585,7 @@ function forTerminal(text3) {
   }
   return printable2;
 }
-async function registerClient(fetchImpl, metadata, redirectUri, signal) {
+async function registerClient(fetchImpl, metadata, redirectUri, signal, scopes) {
   const response = await fetchImpl(metadata.registration_endpoint, {
     method: "POST",
     headers: {
@@ -2555,8 +2598,8 @@ async function registerClient(fetchImpl, metadata, redirectUri, signal) {
       token_endpoint_auth_method: "none",
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
-      scope: REQUESTED_SCOPES.join(" "),
-      type: "native"
+      scope: scopes.join(" "),
+      application_type: "native"
     }),
     signal
   });
@@ -2634,6 +2677,7 @@ async function postTokenRequest(fetchImpl, endpoint, form, signal) {
 async function loginWithBrowser(options) {
   const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
   const now = options.now ?? Date.now;
+  const scopes = options.scopes ?? REQUESTED_SCOPES;
   const metadata = await discoverAuthorizationServer(options.baseUrl, {
     fetch: fetchImpl,
     signal: options.signal
@@ -2651,7 +2695,7 @@ async function loginWithBrowser(options) {
       response_type: "code",
       client_id: clientId,
       redirect_uri: listener.redirectUri,
-      scope: REQUESTED_SCOPES.join(" "),
+      scope: scopes.join(" "),
       state,
       code_challenge: codeChallengeS256(verifier),
       code_challenge_method: "S256",
@@ -2661,7 +2705,8 @@ async function loginWithBrowser(options) {
   };
   try {
     const previous = options.previous;
-    const reusable = previous !== void 0 && previous.tokenEndpoint === metadata.token_endpoint && sameLoopbackRedirect(previous.redirectUri, listener.redirectUri);
+    const needsScopedRegistration = options.scopes !== void 0;
+    const reusable = !needsScopedRegistration && previous !== void 0 && previous.tokenEndpoint === metadata.token_endpoint && sameLoopbackRedirect(previous.redirectUri, listener.redirectUri);
     let clientId;
     let registeredRedirectUri;
     if (reusable && !await clientIsUnusable(
@@ -2676,7 +2721,8 @@ async function loginWithBrowser(options) {
         fetchImpl,
         metadata,
         listener.redirectUri,
-        options.signal
+        options.signal,
+        scopes
       );
       registeredRedirectUri = listener.redirectUri;
     }
@@ -2844,6 +2890,13 @@ async function refreshAccessToken(needsRefresh, partial = {}, signal) {
     { lockPath: deps.lockPath, signal }
   );
 }
+async function projectAccessToken(origin, projectId, signal) {
+  return refreshAccessToken(
+    (current) => current.expiresAt - Date.now() <= REFRESH_WINDOW_MS,
+    { origin, projectId },
+    signal
+  );
+}
 function createOAuthFetch(partial = {}, apiFetch = (input, init) => fetch(input, init)) {
   const deps = defaults(partial);
   const send = (input, init, token) => {
@@ -3583,8 +3636,9 @@ function decideCheckoutVerdict(input) {
 
 // src/lib/user-agent.ts
 var INSTRUCTIONS_STREAMING_CAPABILITY = "instructions-stream-v1";
+var INSTRUCTIONS_REPOSITORY_DIRECT_CAPABILITY = "instructions-repository-direct-v1";
 function cliUserAgent(version = package_default.version, nodeVersion = process.versions.node, platform = process.platform) {
-  return `fabric-cli/${version} (node/${nodeVersion}; ${platform}; ${INSTRUCTIONS_STREAMING_CAPABILITY})`;
+  return `fabric-cli/${version} (node/${nodeVersion}; ${platform}; ${INSTRUCTIONS_STREAMING_CAPABILITY}; ${INSTRUCTIONS_REPOSITORY_DIRECT_CAPABILITY})`;
 }
 var MAX_NOTICE_CHARS = 300;
 var notice = null;
@@ -3954,7 +4008,8 @@ async function signInWithBrowser(input) {
     previous: getRegisteredClient(input.origin, input.project),
     openBrowser,
     announce: input.announce,
-    signal: input.signal
+    signal: input.signal,
+    ...input.scopes === void 0 ? {} : { scopes: input.scopes }
   });
   if (!isIssuedBy(credentials.issuer, input.origin)) {
     throw new SignInRefusedError(input.origin, "issued-elsewhere");
@@ -3978,6 +4033,10 @@ async function signInWithBrowser(input) {
     await revokeOAuthSession(credentials);
     throw new SignInRefusedError(input.origin, "rejected");
   }
+  if (input.scopes?.some((scope) => !me.scopes.includes(scope))) {
+    await revokeOAuthSession(credentials);
+    throw new SignInRefusedError(input.origin, "rejected");
+  }
   saveOAuth(credentials, {
     ...input.explicit ? { baseUrl: input.baseUrl } : { origin: input.origin },
     ...input.project === void 0 ? {} : { projectId: input.project }
@@ -4569,10 +4628,359 @@ function buildCompletionCommand() {
   return completion;
 }
 
+// src/commands/connect/chatgpt.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { Command as Command8 } from "commander";
+
+// src/lib/chatgpt-plan/flow.ts
+import { randomBytes as randomBytes2, randomUUID as randomUUID2 } from "crypto";
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+var CHATGPT_ISSUER = "https://auth.openai.com";
+var AUTHORIZE_URL = `${CHATGPT_ISSUER}/api/accounts/authorize`;
+var TOKEN_URL = `${CHATGPT_ISSUER}/api/accounts/oauth/token`;
+var RESOURCE = "https://api.openai.com/v1";
+var CHATGPT_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPES = `openid profile email offline_access resource.invoke ${CHATGPT_PLAN_SCOPE}`;
+var DYNAMIC_CLIENT_ID = "dynamic_agent_client";
+var CHATGPT_CALLBACK_PATH = "/auth/callback";
+var CHATGPT_CALLBACK_PORT = 1455;
+var AGENT_NAME = "Fabric";
+function registrationPath() {
+  return join(dirname(getConfigPath()), "chatgpt-plan-host.json");
+}
+async function loadRegistration(path29 = registrationPath()) {
+  try {
+    return JSON.parse(await readFile(path29, "utf8"));
+  } catch {
+    return { hostId: `urn:uuid:${randomUUID2()}` };
+  }
+}
+async function saveRegistration(registration, path29 = registrationPath()) {
+  await mkdir(dirname(path29), { recursive: true, mode: 448 });
+  await writeFile(path29, JSON.stringify(registration), { mode: 384 });
+}
+function randomToken() {
+  return randomBytes2(24).toString("base64url");
+}
+function buildAuthorizeUrl(params) {
+  const query = new URLSearchParams({
+    client_id: params.clientId,
+    ext_agent_host_id: params.hostId,
+    response_type: "code",
+    redirect_uri: params.redirectUri,
+    scope: SCOPES,
+    resource: RESOURCE,
+    state: params.state,
+    nonce: params.nonce,
+    code_challenge: params.codeChallenge,
+    code_challenge_method: "S256"
+  });
+  if (params.clientId === DYNAMIC_CLIENT_ID) {
+    query.set("agent_name_hint", AGENT_NAME);
+  }
+  return `${AUTHORIZE_URL}?${query.toString()}`;
+}
+function issuedClientId(params, registration) {
+  const issued = params.get("client_id") ?? registration.clientId;
+  if (!issued || issued === DYNAMIC_CLIENT_ID) {
+    throw new Error(
+      "OpenAI did not issue a client id for this machine; run the command again"
+    );
+  }
+  if (registration.clientId && issued !== registration.clientId) {
+    throw new Error(
+      "The sign-in came back for a different client than this machine's; run again with --new-registration"
+    );
+  }
+  return issued;
+}
+async function exchangeCode(params, fetchImpl = fetch) {
+  const response = await fetchImpl(TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: params.clientId,
+      code: params.code,
+      code_verifier: params.codeVerifier,
+      redirect_uri: params.redirectUri,
+      resource: RESOURCE
+    }).toString(),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text3 = await response.text();
+  if (!response.ok) {
+    let code = `HTTP ${response.status}`;
+    try {
+      const parsed = JSON.parse(text3);
+      if (typeof parsed.error === "string") {
+        code = parsed.error;
+      }
+    } catch {
+    }
+    throw new Error(`OpenAI refused the sign-in code (${code})`);
+  }
+  return JSON.parse(text3);
+}
+function checkIdToken(idToken, expected) {
+  const payload = idToken.split(".")[1];
+  if (!payload) {
+    throw new Error("OpenAI returned a malformed ID token");
+  }
+  const claims = JSON.parse(
+    Buffer.from(payload, "base64url").toString("utf8")
+  );
+  if (claims.nonce !== expected.nonce) {
+    throw new Error("The ID token does not belong to this sign-in");
+  }
+  if (!claims.sub) {
+    throw new Error("The ID token names no account");
+  }
+  if (expected.subject && claims.sub !== expected.subject) {
+    throw new Error(
+      "Signed in as a different ChatGPT account than this machine's; run again with --new-registration to switch"
+    );
+  }
+  return { sub: claims.sub, email: claims.email };
+}
+function buildUploadPayload(tokens, registration) {
+  if (!tokens.refresh_token || !tokens.id_token) {
+    throw new Error("OpenAI's reply is missing the refresh or ID token");
+  }
+  const scopes = (tokens.scope ?? "").split(" ").filter(Boolean);
+  if (!scopes.includes(CHATGPT_PLAN_SCOPE)) {
+    throw new Error(
+      "ChatGPT plan usage was not allowed at sign-in; nothing was sent to Fabric"
+    );
+  }
+  return {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    idToken: tokens.id_token,
+    tokenType: tokens.token_type,
+    expiresIn: tokens.expires_in,
+    scopes,
+    clientId: registration.clientId,
+    hostId: registration.hostId,
+    ...tokens.earliest_refresh_at !== void 0 && {
+      earliestRefreshAt: tokens.earliest_refresh_at
+    }
+  };
+}
+var FABRIC_APPROVAL_CALLBACK_PATH = "/fabric/callback";
+function buildApprovalUrl(origin, params) {
+  const query = new URLSearchParams({
+    port: String(params.port),
+    state: params.state,
+    ...params.sharedOrganizationSlug !== void 0 && {
+      shared: "1",
+      org: params.sharedOrganizationSlug
+    }
+  });
+  return `${origin}/connect/chatgpt?${query.toString()}`;
+}
+async function uploadChatGptPlan(params, fetchImpl = fetch) {
+  const response = await fetchImpl(
+    `${params.origin}/api/connect/chatgpt/credentials`,
+    {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${params.ticket}`
+      },
+      body: JSON.stringify(params.payload),
+      signal: AbortSignal.timeout(3e4)
+    }
+  );
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new Error(
+      body.error ?? `Fabric refused the ChatGPT plan sign-in (HTTP ${response.status})`
+    );
+  }
+  return body;
+}
+
+// src/commands/connect/chatgpt.ts
+var CHATGPT_PLAN_NOT_ENABLED = "ChatGPT plan isn't enabled for any of your organizations. Ask your Fabric admin to enable it.";
+var CHATGPT_PLAN_SHARED_NOT_ALLOWED = "You can connect a shared ChatGPT plan account only to an organization you administer, with ChatGPT plan pooling enabled.";
+function connectOptionsError(opts) {
+  if (opts.shared && !opts.org) {
+    return "--shared needs --org <slug>: the organization the account is shared with.";
+  }
+  if (opts.org && !opts.shared) {
+    return "--org is used only with --shared, to connect an account the organization shares.";
+  }
+  return null;
+}
+function open(url, what) {
+  process.stdout.write(
+    `Opening your browser to ${what}. If it does not open, visit:
+${url}
+`
+  );
+  try {
+    openBrowser(url);
+  } catch {
+  }
+}
+async function approveInFabric(origin, sharedOrganizationSlug) {
+  const state = createState();
+  const listener = await startLoopbackListener({
+    state,
+    callbackPath: FABRIC_APPROVAL_CALLBACK_PATH,
+    codeParam: "ticket"
+  });
+  const port = Number(new URL(listener.redirectUri).port);
+  open(
+    buildApprovalUrl(origin, { port, state, sharedOrganizationSlug }),
+    "approve the connection in Fabric"
+  );
+  try {
+    return (await listener.result).code;
+  } catch (err) {
+    if (err.message.includes("chatgpt_plan_not_enabled")) {
+      throw new Error(CHATGPT_PLAN_NOT_ENABLED);
+    }
+    if (err.message.includes("chatgpt_plan_shared_not_allowed")) {
+      throw new Error(CHATGPT_PLAN_SHARED_NOT_ALLOWED);
+    }
+    throw err;
+  } finally {
+    listener.close();
+  }
+}
+function describeOrganizations(result) {
+  const enabled = result.organizations.filter((org) => org.enabled);
+  if (enabled.length === 0) {
+    return "Choose where to use it in Fabric settings \u2192 Account \u2192 AI providers.";
+  }
+  return `Your own AI work in ${enabled.map((org) => org.name).join(", ")} now uses your ChatGPT plan.`;
+}
+function describeSharedAccount(result) {
+  const account = result.email ? ` (${result.email})` : "";
+  const { organization, created } = result.shared;
+  return `${created ? "Connected" : "Reconnected"} the ChatGPT account${account} as a shared account of ${organization.name}. Choose which work it serves in ${organization.name}'s settings \u2192 AI providers.`;
+}
+async function connect(opts) {
+  const optionsError = connectOptionsError(opts);
+  if (optionsError) {
+    printError(optionsError, 2);
+  }
+  const origin = normalizeOrigin(
+    opts.baseUrl ?? getBaseUrl() ?? DEFAULT_ORIGIN
+  );
+  if (origin === null) {
+    printError(BAD_BASE_URL_LINE, 2);
+  }
+  const sharedOrganizationSlug = opts.shared ? opts.org : void 0;
+  let ticket;
+  try {
+    ticket = await approveInFabric(origin, sharedOrganizationSlug);
+  } catch (err) {
+    printError(err.message, 1);
+  }
+  const stored = await loadRegistration();
+  let registration = stored;
+  if (sharedOrganizationSlug) {
+    registration = { hostId: `urn:uuid:${randomUUID3()}` };
+  } else if (opts.newRegistration) {
+    registration = { hostId: stored.hostId };
+  }
+  const verifier = createCodeVerifier();
+  const state = createState();
+  const nonce = randomToken();
+  const listener = await startLoopbackListener({
+    state,
+    callbackPath: CHATGPT_CALLBACK_PATH,
+    preferredPort: CHATGPT_CALLBACK_PORT
+  });
+  open(
+    buildAuthorizeUrl({
+      clientId: registration.clientId ?? DYNAMIC_CLIENT_ID,
+      hostId: registration.hostId,
+      redirectUri: listener.redirectUri,
+      state,
+      nonce,
+      codeChallenge: codeChallengeS256(verifier)
+    }),
+    "sign in with ChatGPT"
+  );
+  let result;
+  let clientId;
+  let subject;
+  try {
+    const { code, params } = await listener.result;
+    clientId = issuedClientId(params, registration);
+    if (!sharedOrganizationSlug) {
+      await saveRegistration({ ...registration, clientId });
+    }
+    const tokens = await exchangeCode({
+      clientId,
+      code,
+      codeVerifier: verifier,
+      redirectUri: listener.redirectUri
+    });
+    subject = checkIdToken(tokens.id_token ?? "", {
+      nonce,
+      subject: registration.subject
+    }).sub;
+    result = await uploadChatGptPlan({
+      origin,
+      ticket,
+      payload: buildUploadPayload(tokens, {
+        clientId,
+        hostId: registration.hostId
+      })
+    });
+  } catch (err) {
+    printError(err.message, 1);
+  } finally {
+    listener.close();
+  }
+  if ("shared" in result) {
+    printSuccess(describeSharedAccount(result));
+    return;
+  }
+  await saveRegistration({ hostId: registration.hostId, clientId, subject });
+  printSuccess(
+    `Connected your ChatGPT plan${result.email ? ` (${result.email})` : ""} to Fabric.`
+  );
+  process.stdout.write(`${describeOrganizations(result)}
+`);
+}
+function buildConnectCommand() {
+  const connectCommand = new Command8("connect").description(
+    "Connect a personal AI subscription to Fabric"
+  );
+  connectCommand.addCommand(
+    new Command8("chatgpt").description(
+      "Approve in Fabric, sign in with ChatGPT and run your own Fabric AI work on your plan"
+    ).option(
+      "--new-registration",
+      "Register this machine with OpenAI again, for example to switch accounts"
+    ).option(
+      "--base-url <url>",
+      "Deployment to connect, such as https://example.com"
+    ).option(
+      "--org <slug>",
+      "With --shared: the organization to share the account with"
+    ).option(
+      "--shared",
+      "Connect a ChatGPT account the organization shares, instead of your own plan (organization admins)"
+    ).action(connect)
+  );
+  return connectCommand;
+}
+
 // src/commands/context/index.ts
 import { lstat as lstat3 } from "fs/promises";
 import path6 from "path";
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 
 // src/lib/command-boundary.ts
 function outputFormatFor(command) {
@@ -4643,13 +5051,13 @@ function asCliFailure(error) {
 import path3 from "path";
 
 // src/lib/instructions/safe-write.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 import { constants } from "fs";
 import {
   lstat,
-  mkdir,
-  open,
-  readFile,
+  mkdir as mkdir2,
+  open as open2,
+  readFile as readFile2,
   realpath,
   rename,
   unlink
@@ -4810,7 +5218,7 @@ function permissionBits(mode) {
   return mode & 4095;
 }
 async function resolveDestinationRoot(destination) {
-  await mkdir(destination, { recursive: true });
+  await mkdir2(destination, { recursive: true });
   return realpath(destination);
 }
 async function assertSafeTarget(root, relativePath) {
@@ -4875,7 +5283,7 @@ async function openFileSafely(root, relativePath) {
   }
   let handle;
   try {
-    handle = await open(
+    handle = await open2(
       check.path,
       constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
     );
@@ -5002,7 +5410,7 @@ async function makeParents(root, relativePath) {
     current = path2.join(current, segment);
     const stats = await lstatOrNull(current);
     if (stats === null) {
-      await mkdir(current).catch(async (error) => {
+      await mkdir2(current).catch(async (error) => {
         if (error.code !== "EEXIST") {
           throw error;
         }
@@ -5043,11 +5451,11 @@ async function writeFileSafely(input) {
   const directoryBefore = await lstatOrNull(directory);
   const temporary = path2.join(
     directory,
-    `.${path2.basename(target)}.${randomBytes2(8).toString("hex")}.tmp`
+    `.${path2.basename(target)}.${randomBytes3(8).toString("hex")}.tmp`
   );
   let handle = null;
   try {
-    handle = await open(temporary, "wx", 384);
+    handle = await open2(temporary, "wx", 384);
     await handle.writeFile(input.bytes);
     const bits = permissionBits(input.mode);
     if (bits !== null && process.platform !== "win32") {
@@ -5106,7 +5514,7 @@ async function deleteFileSafely(root, relativePath, expectedSha256) {
   }
   let actual;
   try {
-    actual = createHash2("sha256").update(await readFile(check.path)).digest("hex");
+    actual = createHash2("sha256").update(await readFile2(check.path)).digest("hex");
   } catch (error) {
     if (error.code === "ENOENT") {
       return "missing";
@@ -6528,7 +6936,7 @@ function collectPattern(value, previous) {
   return [...previous, value];
 }
 function buildContextCommand() {
-  const context = new Command8("context").description(
+  const context = new Command9("context").description(
     "Sync local knowledge files into a project's Context"
   );
   context.command("push").description(
@@ -6796,9 +7204,9 @@ function throwIfIncomplete(results, prune, pruneTargets) {
 }
 
 // src/commands/ctx/index.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 function buildCtxCommand() {
-  const ctx = new Command9("ctx").description(
+  const ctx = new Command10("ctx").description(
     "Manage the organization commands run in"
   );
   ctx.command("current").description("Show the active default context").action(() => {
@@ -6818,7 +7226,7 @@ function buildCtxCommand() {
     process.stdout.write(`Context: org:${stored.slug}
 `);
   });
-  const use = new Command9("use").description(
+  const use = new Command10("use").description(
     "Set the default organization for commands"
   );
   use.command("personal").description("Retired \u2014 context is organization-only").action(() => {
@@ -6836,9 +7244,9 @@ function buildCtxCommand() {
 }
 
 // src/commands/features/index.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 function buildFeaturesCommand() {
-  const features = new Command10("features").description(
+  const features = new Command11("features").description(
     "Manage project features"
   );
   features.command("list").description("List features in a project").requiredOption("-p, --project <id>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
@@ -7025,9 +7433,9 @@ function buildFeaturesCommand() {
 }
 
 // src/commands/frames/index.ts
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 function buildFramesCommand() {
-  const frames = new Command11("frames").description(
+  const frames = new Command12("frames").description(
     "Manage AI-generated frames and slideshows"
   );
   frames.command("list").description("List frames and slideshows").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--limit <n>", "Max results (default 50)", "50").option(
@@ -7103,7 +7511,7 @@ function buildFramesCommand() {
 // src/commands/instructions/index.ts
 import { readdir as readdir3 } from "fs/promises";
 import path28 from "path";
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/lib/environment.ts
 function isFlagSet(value) {
@@ -7171,7 +7579,7 @@ var STRIPPED_VARIABLES = /* @__PURE__ */ new Set([
   "GIT_CONFIG_SYSTEM",
   "GIT_CONFIG_NOSYSTEM"
 ]);
-var STRIPPED_PATTERN = /^(?:FABRIC_|GIT_CONFIG_(?:KEY|VALUE)_\d+$)/;
+var STRIPPED_PATTERN = /^GIT_CONFIG_(?:KEY|VALUE)_\d+$/;
 var CREDENTIAL_PROGRAMS = /* @__PURE__ */ new Set(["GIT_ASKPASS", "SSH_ASKPASS"]);
 var SSH_PROGRAM_CHOICES = /* @__PURE__ */ new Set(["GIT_SSH_COMMAND", "GIT_SSH"]);
 function gitEnvironment(source = process.env, options = {}) {
@@ -7182,7 +7590,7 @@ function gitEnvironment(source = process.env, options = {}) {
       env2[name] = value;
       continue;
     }
-    if (STRIPPED_VARIABLES.has(upper) || STRIPPED_PATTERN.test(upper)) {
+    if (STRIPPED_VARIABLES.has(upper) || upper.startsWith("FABRIC_") || upper.startsWith("GIT_TRACE") || STRIPPED_PATTERN.test(upper)) {
       continue;
     }
     env2[name] = value;
@@ -7204,6 +7612,34 @@ function gitEnvironment(source = process.env, options = {}) {
 function hookWriteEnvironment(source = process.env) {
   return gitEnvironment(source, { write: true, unattended: true });
 }
+function gatewayConfig(authorization) {
+  if (authorization === void 0) {
+    return { args: [], env: {} };
+  }
+  try {
+    const url = new URL(authorization.url);
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || authorization.authorization === "" || /[\r\n]/.test(authorization.authorization)) {
+      return null;
+    }
+    const base = url.toString().replace(/\/$/, "");
+    return {
+      args: [
+        "-c",
+        `http.${base}.extraHeader=`,
+        `--config-env=http.${base}.extraHeader=FABRIC_GIT_AUTH_HEADER`,
+        "-c",
+        "http.followRedirects=false",
+        "-c",
+        "credential.helper="
+      ],
+      env: {
+        FABRIC_GIT_AUTH_HEADER: `Authorization: ${authorization.authorization}`
+      }
+    };
+  } catch {
+    return null;
+  }
+}
 function runGit(cwd, args, deadline, options = {}) {
   const remaining = deadline - Date.now();
   if (remaining <= 0) {
@@ -7213,6 +7649,14 @@ function runGit(cwd, args, deadline, options = {}) {
     });
   }
   return new Promise((resolve) => {
+    const gateway = gatewayConfig(options.httpAuthorization);
+    if (gateway === null) {
+      resolve({
+        kind: "unavailable",
+        reason: "invalid Fabric Git transport"
+      });
+      return;
+    }
     let settled = false;
     const finish = (result) => {
       if (!settled) {
@@ -7226,6 +7670,7 @@ function runGit(cwd, args, deadline, options = {}) {
       child = spawn2(
         "git",
         [
+          ...gateway.args,
           // Windows Git can report modified long-path files from its file
           // system cache even when Git's diff is empty. This command-local
           // setting keeps inspection truthful without changing the user's
@@ -7238,7 +7683,10 @@ function runGit(cwd, args, deadline, options = {}) {
         ],
         {
           cwd,
-          env: options.write && options.unattended ? hookWriteEnvironment(process.env) : gitEnvironment(process.env, options),
+          env: {
+            ...options.write && options.unattended ? hookWriteEnvironment(process.env) : gitEnvironment(process.env, options),
+            ...gateway.env
+          },
           stdio: ["ignore", "pipe", "pipe"],
           shell: false,
           windowsHide: true
@@ -7250,9 +7698,13 @@ function runGit(cwd, args, deadline, options = {}) {
     }
     const out = [];
     let outBytes = 0;
+    let outOverflow = false;
     const err = [];
     let errBytes = 0;
     child.stdout?.on("data", (chunk) => {
+      if (chunk.length > STDOUT_CAP_BYTES - outBytes) {
+        outOverflow = true;
+      }
       if (outBytes < STDOUT_CAP_BYTES) {
         const room = STDOUT_CAP_BYTES - outBytes;
         out.push(chunk.subarray(0, room));
@@ -7280,6 +7732,13 @@ function runGit(cwd, args, deadline, options = {}) {
     });
     child.on("close", (code) => {
       clearTimeout(escalate);
+      if (outOverflow) {
+        finish({
+          kind: "unavailable",
+          reason: "git output exceeded the supported size"
+        });
+        return;
+      }
       finish({
         kind: "exited",
         code: code ?? -1,
@@ -7340,6 +7799,37 @@ async function simple(root, args, deadline) {
   };
 }
 
+// src/lib/instructions/git-diff.ts
+async function changedTrackedPaths(root, deadline) {
+  const result = await simple(
+    root,
+    [
+      "diff",
+      "--name-only",
+      "--no-renames",
+      "--no-ext-diff",
+      "--no-textconv",
+      "--relative",
+      "-z",
+      "HEAD",
+      "--",
+      "."
+    ],
+    deadline
+  );
+  if (result.kind !== "ok") return result;
+  if (result.value.code !== 0) {
+    return {
+      kind: "unavailable",
+      reason: "Git could not compare this checkout to HEAD"
+    };
+  }
+  return {
+    kind: "ok",
+    value: result.value.stdout.split("\0").filter(Boolean)
+  };
+}
+
 // src/lib/instructions/git-write.ts
 function fetchFailureOf(stderr) {
   if (/\(non-fast-forward\)|\[rejected\]|cannot fast-forward/i.test(stderr)) {
@@ -7371,6 +7861,9 @@ function mergeFailureOf(stderr) {
   )) {
     return "busy";
   }
+  if (/would be overwritten by merge/i.test(stderr) && /local changes|untracked working tree files/i.test(stderr)) {
+    return "local-changes";
+  }
   if (/Not possible to fast-forward|refusing to merge unrelated histories|diverging branches/i.test(
     stderr
   )) {
@@ -7378,6 +7871,20 @@ function mergeFailureOf(stderr) {
   }
   return "other";
 }
+function blockedFilesOf(stderr) {
+  const files = [];
+  let listing = false;
+  for (const line2 of stderr.split(/\r?\n/)) {
+    if (/would be overwritten by merge:\s*$/i.test(line2)) {
+      listing = true;
+    } else if (listing && /^\s+\S/.test(line2)) {
+      files.push(line2.trim());
+    } else {
+      listing = false;
+    }
+  }
+  return files;
+}
 async function fetchRef(root, remote, ref, deadline) {
   if (!isRemoteName(remote) || !isBranchLiteral(ref)) {
     return { kind: "unavailable", reason: "not a branch this will fetch" };
@@ -7419,6 +7926,47 @@ async function fetchRef(root, remote, ref, deadline) {
   }
   return { kind: "fetched", tip: sha };
 }
+async function fetchRefFromUrl(root, url, remote, ref, deadline, httpAuthorization) {
+  if (!isRemoteName(remote) || !isBranchLiteral(ref)) {
+    return { kind: "unavailable", reason: "not a branch this will fetch" };
+  }
+  const tracking = `refs/remotes/${remote}/${ref}`;
+  const fetched = await runGit(
+    root,
+    [
+      "-c",
+      "gc.auto=0",
+      "-c",
+      "maintenance.auto=false",
+      "fetch",
+      "--no-recurse-submodules",
+      "--",
+      url,
+      `refs/heads/${ref}:${tracking}`
+    ],
+    deadline,
+    { write: true, unattended: true, httpAuthorization }
+  );
+  if (fetched.kind === "unavailable") {
+    return fetched.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: fetched.reason };
+  }
+  if (fetched.code !== 0) {
+    return { kind: "failed", reason: fetchFailureOf(fetched.stderr) };
+  }
+  const tip = await runGit(
+    root,
+    ["rev-parse", "--verify", "-q", `${tracking}^{commit}`],
+    deadline
+  );
+  if (tip.kind === "unavailable") {
+    return tip.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: tip.reason };
+  }
+  const [sha] = lines(tip.stdout);
+  if (tip.code !== 0 || !sha || !COMMIT_SHA.test(sha)) {
+    return { kind: "failed", reason: "missing-ref" };
+  }
+  return { kind: "fetched", tip: sha };
+}
 async function fastForwardTo(root, sha, deadline) {
   if (!COMMIT_SHA.test(sha)) {
     return { kind: "unavailable", reason: "not a commit name" };
@@ -7433,7 +7981,8 @@ async function fastForwardTo(root, sha, deadline) {
     return merged.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: merged.reason };
   }
   if (merged.code !== 0) {
-    return { kind: "failed", reason: mergeFailureOf(merged.stderr) };
+    const reason = mergeFailureOf(merged.stderr);
+    return reason === "local-changes" ? { kind: "failed", reason, files: blockedFilesOf(merged.stderr) } : { kind: "failed", reason };
   }
   const head = await runGit(
     root,
@@ -7460,7 +8009,6 @@ var OPERATION_MARKERS = [
   // HEAD markers above name which one while a step is stopped.
   { marker: "sequencer", operation: "cherry-pick" }
 ];
-var OWN_PATHS = [".claude/settings.local.json", ".codex/hooks.json"];
 async function nearestExistingDirectory(dir) {
   let current = path7.resolve(dir);
   for (; ; ) {
@@ -7627,28 +8175,26 @@ async function isAncestor(root, ancestorSha, descendantSha, deadline) {
   return { kind: "unavailable", reason: "the commit is not in this clone" };
 }
 async function isClean(root, deadline) {
-  const everythingElse = await porcelainIsEmpty(
-    root,
-    [
-      "--untracked-files=normal",
-      "--",
-      ":/",
-      ...OWN_PATHS.map((own) => `:(exclude,top)${own}`)
-    ],
-    deadline
-  );
-  if (everythingElse.kind !== "ok" || !everythingElse.value) {
-    return everythingElse;
-  }
-  return porcelainIsEmpty(
-    root,
-    [
-      "--untracked-files=no",
-      "--",
-      ...OWN_PATHS.map((own) => `:(top)${own}`)
-    ],
-    deadline
-  );
+  for (const scope of [[], ["--cached"]]) {
+    const result = await simple(
+      root,
+      ["diff", "--quiet", "--ignore-submodules=none", ...scope],
+      deadline
+    );
+    if (result.kind !== "ok") {
+      return result;
+    }
+    if (result.value.code === 1) {
+      return { kind: "ok", value: false };
+    }
+    if (result.value.code !== 0) {
+      return {
+        kind: "unavailable",
+        reason: `git exited with status ${result.value.code}`
+      };
+    }
+  }
+  return { kind: "ok", value: true };
 }
 async function trackedPaths(root, relativePaths, deadline) {
   if (relativePaths.length === 0) {
@@ -7721,23 +8267,6 @@ async function checkoutAppearsIncomplete(root, deadline) {
     value: headTree.value.stdout !== "" && staged.value.code === 1 && untracked.value.stdout !== ""
   };
 }
-async function porcelainIsEmpty(root, args, deadline) {
-  const result = await simple(
-    root,
-    ["status", "--porcelain=v1", "--ignore-submodules=none", ...args],
-    deadline
-  );
-  if (result.kind !== "ok") {
-    return result;
-  }
-  if (result.value.code !== 0) {
-    return {
-      kind: "unavailable",
-      reason: `git exited with status ${result.value.code}`
-    };
-  }
-  return { kind: "ok", value: result.value.stdout.trim() === "" };
-}
 async function operationInProgress(root, deadline) {
   const result = await simple(
     root,
@@ -7964,8 +8493,9 @@ function cloneFailureOf(stderr) {
   }
   return "other";
 }
-async function cloneInto(dir, url, ref, deadline) {
-  if (cloneableUrl(url) !== url || !isBranchLiteral(ref)) {
+async function cloneInto(dir, url, ref, deadline, options = {}) {
+  const validUrl = options.httpAuthorization ? options.httpAuthorization.url === url : cloneableUrl(url) === url;
+  if (!validUrl || !isBranchLiteral(ref)) {
     return {
       kind: "unavailable",
       reason: "not a repository this will clone"
@@ -7990,13 +8520,28 @@ async function cloneInto(dir, url, ref, deadline) {
       "."
     ],
     deadline,
-    { write: true }
+    { write: true, ...options }
   );
   if (result.kind === "unavailable") {
     return { kind: "unavailable", reason: result.reason };
   }
   return result.code === 0 ? { kind: "cloned" } : { kind: "failed", reason: cloneFailureOf(result.stderr) };
 }
+async function setRemoteUrl(root, remote, url, deadline) {
+  if (!isRemoteName(remote) || cloneableUrl(url) !== url) {
+    return { kind: "unavailable", reason: "not a repository remote" };
+  }
+  const result = await runGit(
+    root,
+    ["remote", "set-url", remote, url],
+    deadline,
+    { write: true }
+  );
+  if (result.kind === "unavailable") {
+    return result;
+  }
+  return result.code === 0 ? { kind: "ok", value: void 0 } : { kind: "unavailable", reason: "git refused the provider remote" };
+}
 
 // src/lib/instructions/outcome.ts
 var HOOK_PREFIX = "fabric: coding instructions";
@@ -8005,6 +8550,15 @@ var TRAIT_TEXT = {
   sparse: " (sparse checkout)",
   superproject: " (inside a superproject)"
 };
+var MAX_BLOCKED_FILES = 3;
+function blockedFilesText(files) {
+  if (files.length === 0) {
+    return "";
+  }
+  const named = files.slice(0, MAX_BLOCKED_FILES).map(shown).join(", ");
+  const more = files.length - MAX_BLOCKED_FILES;
+  return ` (${named}${more > 0 ? ` and ${more} more` : ""})`;
+}
 function shown(value) {
   return sanitizeDisplayText(value, 255);
 }
@@ -8154,8 +8708,10 @@ var LINES = {
         return reason;
     }
   },
-  "ff-merge-failed": ({ reason, ref, remote, commands }) => {
+  "ff-merge-failed": ({ reason, files, ref, remote, commands }) => {
     switch (reason) {
+      case "local-changes":
+        return `${HOOK_PREFIX}: ${ref} is behind ${remote}/${ref}, but local changes would be overwritten${blockedFilesText(files ?? [])}, so nothing was updated. Commit or stash them, then run: ${commands.pull}`;
       case "diverged":
         return `${HOOK_PREFIX}: ${ref} and ${remote}/${ref} have diverged, so nothing was updated. Run: ${commands.rebase}, or merge ${remote}/${ref} yourself.`;
       case "timeout":
@@ -8956,7 +9512,7 @@ function adoptionFor(input) {
 }
 
 // src/lib/instructions/agent-mcp-config.ts
-import { readFile as readFile2, stat as stat2 } from "fs/promises";
+import { readFile as readFile3, stat as stat2 } from "fs/promises";
 import path10 from "path";
 var MAX_CONFIG_BYTES = 16 * 1024 * 1024;
 async function readText(file) {
@@ -8965,7 +9521,7 @@ async function readText(file) {
     if (!info.isFile() || info.size > MAX_CONFIG_BYTES) {
       return { kind: "unusable" };
     }
-    return { kind: "text", text: await readFile2(file, "utf8") };
+    return { kind: "text", text: await readFile3(file, "utf8") };
   } catch (error) {
     return error.code === "ENOENT" ? { kind: "absent" } : { kind: "unusable" };
   }
@@ -9106,7 +9662,7 @@ async function readRegistration(input) {
 
 // src/lib/instructions/hook.ts
 import { createHash as createHash4 } from "crypto";
-import { mkdir as mkdir2 } from "fs/promises";
+import { mkdir as mkdir3 } from "fs/promises";
 import { tmpdir } from "os";
 import path11 from "path";
 
@@ -9139,7 +9695,7 @@ function subcommandsForEvent(event) {
 }
 async function withHookConfigLock(root, posixPath, work) {
   const directory = path11.join(tmpdir(), "fabric-instructions-hook-locks");
-  await mkdir2(directory, { recursive: true });
+  await mkdir3(directory, { recursive: true });
   const identity = createHash4("sha256").update(path11.resolve(root)).update("\0").update(posixPath).digest("hex");
   const lockPath2 = path11.join(directory, `${identity}.lock`);
   try {
@@ -10041,7 +10597,7 @@ import { createHash as createHash5 } from "crypto";
 import { chmod } from "fs/promises";
 
 // src/lib/instructions/lock.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import path14 from "path";
 var LOCK_DIRECTORY = ".fabric";
 var LOCK_FILENAME = "instructions.lock";
@@ -10056,7 +10612,7 @@ async function readLock(destination) {
   const file = lockPath(destination);
   let raw;
   try {
-    raw = await readFile3(file, "utf8");
+    raw = await readFile4(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return null;
@@ -13158,7 +13714,7 @@ function replacePath(text3, target, replacement) {
 }
 
 // src/lib/instructions/fast-forward-run.ts
-import { mkdir as mkdir5, realpath as realpath4 } from "fs/promises";
+import { mkdir as mkdir6, realpath as realpath4 } from "fs/promises";
 import path21 from "path";
 
 // src/lib/instructions/fast-forward.ts
@@ -13192,9 +13748,6 @@ function fastForwardEligibility(facts) {
   if (facts.upstream !== `${remote}/${ref}`) {
     return no("upstream-mismatch");
   }
-  if (!state.clean) {
-    return no("dirty");
-  }
   if (facts.lockFiles) {
     return no("git-busy");
   }
@@ -13313,11 +13866,12 @@ function fastForwardLines(outcome, context) {
     case "merge-failed": {
       const text3 = outcomeLine("ff-merge-failed", {
         reason: outcome.reason,
+        files: outcome.files,
         ref: context.ref,
         remote: context.remote,
         commands: context.commands
       });
-      if (outcome.reason === "diverged") {
+      if (outcome.reason === "diverged" || outcome.reason === "local-changes") {
         stdout.push(text3);
         otherLine();
       } else {
@@ -13351,7 +13905,7 @@ function fastForwardLines(outcome, context) {
 }
 
 // src/lib/instructions/fast-forward-memory.ts
-import { mkdir as mkdir3, readFile as readFile4, rename as rename2, rm as rm2, writeFile } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import path19 from "path";
 function noticeFile(commonDir2) {
   return path19.join(commonDir2, "fabric", "ff-notice.json");
@@ -13361,22 +13915,22 @@ function isRecord4(value) {
     return false;
   }
   const record = value;
-  return record.v === 1 && typeof record.projectId === "string" && typeof record.publishedVersion === "number" && typeof record.reason === "string";
+  return record.v === 1 && typeof record.projectId === "string" && typeof record.publishedVersion === "number" && (record.directCommitSha === void 0 || typeof record.directCommitSha === "string") && typeof record.reason === "string";
 }
 async function isNewNotice(file, key) {
   try {
-    const parsed = JSON.parse(await readFile4(file, "utf8"));
-    return !(isRecord4(parsed) && parsed.projectId === key.projectId && parsed.publishedVersion === key.publishedVersion && parsed.reason === key.reason);
+    const parsed = JSON.parse(await readFile5(file, "utf8"));
+    return !(isRecord4(parsed) && parsed.projectId === key.projectId && parsed.publishedVersion === key.publishedVersion && parsed.directCommitSha === key.directCommitSha && parsed.reason === key.reason);
   } catch {
     return true;
   }
 }
 async function rememberNotice(file, key) {
   try {
-    await mkdir3(path19.dirname(file), { recursive: true });
+    await mkdir4(path19.dirname(file), { recursive: true });
     const temporary = `${file}.${process.pid}.tmp`;
     const record = { v: 1, ...key };
-    await writeFile(temporary, `${JSON.stringify(record)}
+    await writeFile2(temporary, `${JSON.stringify(record)}
 `, {
       mode: 384
     });
@@ -13397,7 +13951,7 @@ var hookTiming = {
 };
 
 // src/lib/instructions/hook-trace.ts
-import { mkdir as mkdir4, readFile as readFile5, rename as rename3, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile6, rename as rename3, writeFile as writeFile3 } from "fs/promises";
 import path20 from "path";
 var TRACE_LIMIT = 50;
 function traceFile(configDir) {
@@ -13405,7 +13959,7 @@ function traceFile(configDir) {
 }
 async function appendTrace(file, entry) {
   try {
-    const previous = await readFile5(file, "utf8").catch(() => "");
+    const previous = await readFile6(file, "utf8").catch(() => "");
     const kept = previous.split("\n").filter((line2) => {
       try {
         return typeof JSON.parse(line2)?.outcome === "string";
@@ -13414,9 +13968,9 @@ async function appendTrace(file, entry) {
       }
     }).slice(-(TRACE_LIMIT - 1));
     kept.push(JSON.stringify(entry));
-    await mkdir4(path20.dirname(file), { recursive: true, mode: 448 });
+    await mkdir5(path20.dirname(file), { recursive: true, mode: 448 });
     const temporary = `${file}.${process.pid}.tmp`;
-    await writeFile2(temporary, `${kept.join("\n")}
+    await writeFile3(temporary, `${kept.join("\n")}
 `, { mode: 384 });
     await rename3(temporary, file);
   } catch {
@@ -13425,6 +13979,7 @@ async function appendTrace(file, entry) {
 
 // src/lib/instructions/fast-forward-run.ts
 var MERGE_RESERVE_MS = 1500;
+var MERGE_FLOOR_MS = 500;
 var FF_LOCK_STALE_MS = 3e4;
 var show2 = (value, max = 200) => sanitizeDisplayText(value, max);
 async function samePath(a, b) {
@@ -13476,8 +14031,19 @@ async function readFacts(run3, deadline) {
     heldElsewhere
   };
 }
-function unanswered(deadline, head) {
-  return Date.now() >= deadline ? { outcome: { kind: "deadline" }, head } : { outcome: { kind: "not-safe", reason: "git-busy" }, head };
+function unanswered(deadline, head, stage) {
+  return Date.now() >= deadline ? { outcome: { kind: "deadline", stage }, head } : { outcome: { kind: "not-safe", reason: "git-busy" }, head };
+}
+async function tipRelation(root, head, tip, deadline) {
+  if (tip === head) {
+    return "current";
+  }
+  const forward = await isAncestor(root, head, tip, deadline);
+  if (forward.kind !== "ok" || forward.value) {
+    return "ahead";
+  }
+  const behind = await isAncestor(root, tip, head, deadline);
+  return behind.kind === "ok" && behind.value ? "current" : "diverged";
 }
 async function underLock(run3, first) {
   const { classification, repository, deadline } = run3;
@@ -13486,7 +14052,7 @@ async function underLock(run3, first) {
   const ref = repository.ref;
   const facts = await readFacts(run3, deadline);
   if (facts === null) {
-    return unanswered(deadline, first.state.head);
+    return unanswered(deadline, first.state.head, "read");
   }
   const gate = fastForwardEligibility(facts);
   if (!gate.eligible) {
@@ -13504,12 +14070,19 @@ async function underLock(run3, first) {
   }
   const fetchDeadline = deadline - MERGE_RESERVE_MS;
   if (Date.now() >= fetchDeadline) {
-    return { outcome: { kind: "deadline" }, head };
+    return { outcome: { kind: "deadline", stage: "fetch" }, head };
   }
-  const fetched = await fetchRef(root, remote, ref, fetchDeadline);
+  const fetched = run3.gitTransport ? await fetchRefFromUrl(
+    root,
+    run3.gitTransport.url,
+    remote,
+    ref,
+    fetchDeadline,
+    run3.gitTransport
+  ) : await fetchRef(root, remote, ref, fetchDeadline);
   switch (fetched.kind) {
     case "timed-out":
-      return { outcome: { kind: "deadline" }, head };
+      return { outcome: { kind: "deadline", stage: "fetch" }, head };
     case "unavailable":
       return {
         outcome: { kind: "fetch-failed", reason: "other" },
@@ -13532,30 +14105,26 @@ async function underLock(run3, first) {
       return fetched;
   }
   const tip = fetched.tip;
-  const afterFetch = await factsStillMatch(run3, facts, deadline);
-  if (afterFetch !== null) {
-    return afterFetch;
+  const relation = await tipRelation(root, head, tip, deadline);
+  const changed = await factsStillMatch(run3, facts, deadline);
+  if (changed !== null) {
+    return changed;
   }
-  if (tip === head) {
-    return { outcome: { kind: "already-current" }, head };
-  }
-  const forward = await isAncestor(root, head, tip, deadline);
-  if (forward.kind === "ok" && !forward.value) {
-    const behind = await isAncestor(root, tip, head, deadline);
-    return behind.kind === "ok" && behind.value ? { outcome: { kind: "already-current" }, head } : {
-      outcome: { kind: "merge-failed", reason: "diverged" },
-      head
-    };
-  }
-  if (deadline - Date.now() < MERGE_RESERVE_MS) {
-    return { outcome: { kind: "deadline" }, head };
-  }
-  const beforeMerge = await factsStillMatch(run3, facts, deadline);
-  if (beforeMerge !== null) {
-    return beforeMerge;
+  switch (relation) {
+    case "current":
+      return { outcome: { kind: "already-current" }, head };
+    case "diverged":
+      return {
+        outcome: { kind: "merge-failed", reason: "diverged" },
+        head
+      };
+    case "ahead":
+      break;
+    default:
+      return relation;
   }
-  if (deadline - Date.now() < MERGE_RESERVE_MS) {
-    return { outcome: { kind: "deadline" }, head };
+  if (deadline - Date.now() < MERGE_FLOOR_MS) {
+    return { outcome: { kind: "deadline", stage: "merge" }, head };
   }
   const merged = await fastForwardTo(root, tip, deadline);
   switch (merged.kind) {
@@ -13583,7 +14152,11 @@ async function underLock(run3, first) {
         };
       }
       return {
-        outcome: { kind: "merge-failed", reason: merged.reason },
+        outcome: {
+          kind: "merge-failed",
+          reason: merged.reason,
+          ...merged.files === void 0 ? {} : { files: merged.files }
+        },
         head
       };
     default:
@@ -13593,7 +14166,7 @@ async function underLock(run3, first) {
 async function factsStillMatch(run3, expected, deadline) {
   const facts = await readFacts(run3, deadline);
   if (facts === null) {
-    return unanswered(deadline, expected.state.head);
+    return unanswered(deadline, expected.state.head, "merge");
   }
   const gate = fastForwardEligibility(facts);
   if (!gate.eligible) {
@@ -13619,7 +14192,7 @@ async function decide(run3) {
   }
   const facts = await readFacts(run3, deadline);
   if (facts === null) {
-    return unanswered(deadline, head);
+    return unanswered(deadline, head, "read");
   }
   const gate = fastForwardEligibility(facts);
   if (!gate.eligible) {
@@ -13630,11 +14203,11 @@ async function decide(run3) {
   }
   const common = await commonDir(root, deadline);
   if (common.kind !== "ok") {
-    return unanswered(deadline, head);
+    return unanswered(deadline, head, "read");
   }
   const directory = path21.join(common.value, "fabric");
   try {
-    await mkdir5(directory, { recursive: true });
+    await mkdir6(directory, { recursive: true });
     return await withExclusiveLock(() => underLock(run3, facts), {
       lockPath: path21.join(directory, "ff.lock"),
       staleMs: FF_LOCK_STALE_MS,
@@ -13660,6 +14233,8 @@ function reasonOf(outcome) {
     case "fetch-failed":
     case "merge-failed":
       return outcome.reason;
+    case "deadline":
+      return outcome.stage;
     default:
       return null;
   }
@@ -13668,8 +14243,8 @@ function noticeReason(outcome, lag) {
   if (outcome.kind === "not-safe") {
     return `not-safe:${outcome.reason}`;
   }
-  if (outcome.kind === "merge-failed" && outcome.reason === "diverged") {
-    return "merge-failed:diverged";
+  if (outcome.kind === "merge-failed" && (outcome.reason === "diverged" || outcome.reason === "local-changes")) {
+    return `merge-failed:${outcome.reason}`;
   }
   if ((outcome.kind === "fast-forwarded" || outcome.kind === "already-current") && lag !== null) {
     return `fabric-lags:${lag}`;
@@ -13694,7 +14269,8 @@ async function runFastForward(run3) {
   const decision = await decide(run3);
   const { outcome } = decision;
   const source = snapshot?.source;
-  const publishedSha = source?.kind === "REPOSITORY" && source.current && isCommitSha(source.commitSha) ? source.commitSha : null;
+  const snapshotSha = source?.kind === "REPOSITORY" && source.current && isCommitSha(source.commitSha) ? source.commitSha : null;
+  const publishedSha = run3.directCommitSha ?? snapshotSha;
   const moved = outcome.kind === "fast-forwarded" || outcome.kind === "already-current";
   const head = outcome.kind === "fast-forwarded" ? outcome.to : decision.head;
   let publishedInHistory = null;
@@ -13707,7 +14283,7 @@ async function runFastForward(run3) {
     );
     publishedInHistory = answer.kind === "ok" ? answer.value : null;
   }
-  const lag = moved ? fabricCopyLag({
+  const lag = moved && snapshot !== void 0 ? fabricCopyLag({
     headSha: head,
     publishedSha,
     publishedInHistory,
@@ -13744,6 +14320,7 @@ async function runFastForward(run3) {
       const key = {
         projectId: run3.projectId,
         publishedVersion: snapshot ? Number(snapshot.version) : 0,
+        ...run3.directCommitSha === void 0 ? {} : { directCommitSha: run3.directCommitSha },
         reason
       };
       if (await isNewNotice(notices, key)) {
@@ -13766,7 +14343,7 @@ async function runFastForward(run3) {
 }
 
 // src/lib/instructions/git-exclude.ts
-import { appendFile, lstat as lstat6, mkdir as mkdir6, readFile as readFile6 } from "fs/promises";
+import { appendFile, lstat as lstat6, mkdir as mkdir7, readFile as readFile7 } from "fs/promises";
 import path22 from "path";
 function relativeToTopLevel(toplevel, directory, file) {
   return path22.relative(toplevel, path22.join(directory, file)).split(path22.sep).join("/");
@@ -13803,7 +14380,7 @@ async function excludeLocalFiles(input) {
     if (file.kind !== "ok") {
       return { kind: "failed", entries: missing };
     }
-    await mkdir6(path22.dirname(file.value), { recursive: true });
+    await mkdir7(path22.dirname(file.value), { recursive: true });
     const existing = await lstat6(file.value).catch((error) => {
       if (error.code === "ENOENT") {
         return null;
@@ -13813,7 +14390,7 @@ async function excludeLocalFiles(input) {
     if (existing !== null && !existing.isFile()) {
       return { kind: "failed", entries: missing };
     }
-    const text3 = existing === null ? "" : await readFile6(file.value, "utf8");
+    const text3 = existing === null ? "" : await readFile7(file.value, "utf8");
     const present = new Set(text3.split(/\r?\n/));
     const toAdd = missing.filter((entry) => !present.has(entry));
     if (toAdd.length === 0) {
@@ -13829,7 +14406,7 @@ async function excludeLocalFiles(input) {
 }
 
 // src/lib/instructions/hook-launcher.ts
-import { mkdir as mkdir7, readFile as readFile7, rename as rename4, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir8, readFile as readFile8, rename as rename4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
 import path23 from "path";
 var NOT_ON_PATH_WARNING = "`fabric` is not on this machine's PATH, so this session hook will not run. Run the setup line from the project's Connect dialog instead: it keeps a copy of this deployment's CLI where the hook finds it.";
 var COPY_IN_USE_WARNING = "The CLI copy the session hook runs is in use and could not be replaced, so the earlier copy was kept. Run this again when no coding session is starting.";
@@ -13850,15 +14427,15 @@ function samePath2(a, b) {
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 async function writeCopy(bytes, destination) {
-  await mkdir7(path23.dirname(destination), { recursive: true });
+  await mkdir8(path23.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.tmp`;
-  await writeFile3(temporary, bytes, { mode: 420 });
+  await writeFile4(temporary, bytes, { mode: 420 });
   try {
     await rename4(temporary, destination);
     return true;
   } catch (error) {
     await rm3(temporary, { force: true });
-    const existing = await readFile7(destination).catch(() => null);
+    const existing = await readFile8(destination).catch(() => null);
     if (existing === null) {
       throw error;
     }
@@ -13881,7 +14458,7 @@ async function resolveHookLauncher(input) {
     return { prefix: `node ${word}`, warning: null };
   }
   const current = await writeCopy(
-    await readFile7(input.bundle.scriptPath),
+    await readFile8(input.bundle.scriptPath),
     destination
   );
   return {
@@ -13934,7 +14511,7 @@ async function installHooks(input) {
 // src/lib/instructions/lesson-prompt.ts
 import { createHash as createHash11 } from "crypto";
 import { createReadStream } from "fs";
-import { mkdir as mkdir8, readdir as readdir2, stat as stat5, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir9, readdir as readdir2, stat as stat5, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
 import path24 from "path";
 import { createInterface } from "readline";
 function parseStopHookInput(text3) {
@@ -14084,7 +14661,7 @@ async function runLessonPromptInner(input) {
     return { output: null, why: "stop-hook-active" };
   }
   try {
-    await mkdir8(input.markerDir, { recursive: true });
+    await mkdir9(input.markerDir, { recursive: true });
   } catch (error) {
     debugLog(`marker directory unavailable: ${describeError(error)}`);
     return { output: null, why: "marker-unavailable" };
@@ -14108,7 +14685,7 @@ async function runLessonPromptInner(input) {
     return { output: null, why: "no-edits" };
   }
   try {
-    await writeFile4(markerPath, "", { flag: "wx" });
+    await writeFile5(markerPath, "", { flag: "wx" });
   } catch (error) {
     debugLog(`could not write marker: ${describeError(error)}`);
     return { output: null, why: "marker-unavailable" };
@@ -14143,287 +14720,72 @@ var machine = {
   platform: () => process.platform
 };
 
-// src/lib/instructions/open-proposals.ts
-var openProposalTiming = { deadlineMs: 15e3 };
-var SNAPSHOT_STATUSES = {
-  RECEIVING: true,
-  VALIDATING: true,
-  READY: true,
-  REJECTED: true,
-  FAILED: true
-};
-var PULL_REQUEST_STATES = {
-  QUEUED: true,
-  OPENING: true,
-  OPEN: true,
-  CLOSE_REQUESTED: true,
-  BLOCKED: true,
-  MERGED: true,
-  CLOSED: true,
-  CANCELED: true
-};
-function isKnown(known, value) {
-  return typeof value === "string" && Object.hasOwn(known, value);
-}
-var OpenProposalDeadline = class extends Error {
-  constructor(ms) {
-    super(`it did not answer within ${Math.ceil(ms / 1e3)} s`);
-    this.name = "OpenProposalDeadline";
-  }
-};
-async function lookUpOpenProposals(client, projectId, options = {}) {
-  const ms = openProposalTiming.deadlineMs;
-  const controller = new AbortController();
-  const timer = setTimeout(
-    () => controller.abort(new OpenProposalDeadline(ms)),
-    ms
-  );
-  let answer;
-  try {
-    answer = await client.instructions.getOpenProposals(projectId, {
-      org: options.org,
-      signal: controller.signal
-    });
-  } catch (error) {
-    if (controller.signal.aborted) {
-      return {
-        kind: "unavailable",
-        reason: describeError(controller.signal.reason)
-      };
-    }
-    if (error.status === 404) {
-      return {
-        kind: "unavailable",
-        reason: "this Fabric server does not list open proposals yet"
-      };
-    }
-    const status = error?.status;
-    return {
-      kind: "unavailable",
-      reason: typeof status === "number" && status > 0 ? `the server answered ${status}` : "the request did not go through"
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-  if (!Array.isArray(answer) || !answer.every(isOpenProposal)) {
-    return {
-      kind: "unavailable",
-      reason: "the server's answer was not a list of proposals"
-    };
+// src/lib/instructions/native-push-plan.ts
+import { createHash as createHash13 } from "crypto";
+
+// src/lib/instructions/push.ts
+import { createHash as createHash12 } from "crypto";
+var MAX_PUSH_CHANGES = 50;
+var MAX_INLINE_PUSH_BYTES = 2 * 1024 * 1024;
+function assertPushablePath(candidate, source) {
+  const check = checkRelativePath(candidate);
+  if (!check.ok) {
+    throw new Error(
+      `Refusing to push: ${describeRejection(check)}. ${source}`
+    );
   }
-  return { kind: "found", proposals: answer };
-}
-function isOpenProposal(value) {
-  if (typeof value !== "object" || value === null) {
-    return false;
+  if (isReservedPath(candidate)) {
+    throw new Error(
+      `Refusing to push: ${describeRejection({
+        ok: false,
+        reason: "reserved_path",
+        detail: candidate
+      })}. ${source}`
+    );
   }
-  const proposal = value;
-  const pullRequest = proposal.pullRequest;
-  return typeof proposal.snapshotId === "string" && typeof proposal.version === "number" && typeof proposal.baseSnapshotId === "string" && isKnown(SNAPSHOT_STATUSES, proposal.status) && (pullRequest === null || typeof pullRequest === "object" && pullRequest !== void 0 && isKnown(PULL_REQUEST_STATES, pullRequest.state) && (pullRequest.url === null || typeof pullRequest.url === "string")) && Array.isArray(proposal.changes) && proposal.changes.every(isChange);
 }
-function isChange(value) {
-  if (typeof value !== "object" || value === null) {
-    return false;
+function encodeContent(bytes) {
+  const text3 = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+  const roundTrip = new TextEncoder().encode(text3);
+  if (roundTrip.length === bytes.length && roundTrip.every((byte, index) => byte === bytes[index])) {
+    return { content: text3, encoding: "utf8" };
   }
-  const change = value;
-  return typeof change.path === "string" && (change.op === "put" && typeof change.sha256 === "string" || change.op === "delete" && change.sha256 === null);
+  return {
+    content: Buffer.from(bytes).toString("base64"),
+    encoding: "base64"
+  };
 }
-
-// src/lib/instructions/prompt.ts
-import { createInterface as createInterface2 } from "readline/promises";
-function canPrompt(streams = {
-  stdin: process.stdin,
-  stderr: process.stderr
-}) {
-  return streams.stdin?.isTTY === true && streams.stderr?.isTTY === true;
+function sha256Of(bytes) {
+  return createHash12("sha256").update(bytes).digest("hex");
 }
-async function ask(question, streams) {
-  const reader = createInterface2({
-    input: streams.input,
-    output: streams.output
-  });
-  try {
-    return (await reader.question(question)).trim();
-  } finally {
-    reader.close();
-  }
+function refuseStaleLedger(detail) {
+  throw new Error(
+    `Refusing to push: the sync lock does not match the published version \u2014 ${detail}. Run \`${fabricCommand("instructions sync")}\` and try again. Nothing was read and nothing was sent.`
+  );
 }
-async function chooseProject(projects, streams = { input: process.stdin, output: process.stderr }) {
-  streams.output.write(
-    `This repository is connected to ${projects.length} projects:
-`
+function assertLockMatchesManifest(lock, manifest) {
+  const published = new Map(
+    manifest.map((entry) => [entry.path, entry.sha256])
   );
-  for (const [index, project] of projects.entries()) {
-    streams.output.write(`  [${index + 1}] ${project.label}
-`);
+  for (const [path29, entry] of Object.entries(lock.files)) {
+    const expected = published.get(path29);
+    if (expected === void 0) {
+      refuseStaleLedger(
+        `it lists ${path29}, which version ${lock.snapshotVersion} does not contain`
+      );
+    }
+    if (expected !== entry.sha256) {
+      refuseStaleLedger(
+        `its record of ${path29} is not the published file`
+      );
+    }
   }
-  const answer = await ask(`Which one? [1-${projects.length}] `, streams);
-  const number = /^\d+$/.test(answer) ? Number(answer) : 0;
-  return number >= 1 && number <= projects.length ? number - 1 : null;
-}
-async function confirm(question, streams = { input: process.stdin, output: process.stderr }) {
-  return /^y(es)?$/i.test(await ask(`${question} [y/N] `, streams));
-}
-
-// src/lib/instructions/pull-request-wait.ts
-var PULL_REQUEST_POLL_MS = 2e3;
-var PULL_REQUEST_WAIT_MS = 6e4;
-var SETTLED_STATES = /* @__PURE__ */ new Set([
-  "OPEN",
-  "BLOCKED",
-  "MERGED",
-  "CLOSED",
-  "CANCELED",
-  "CLOSE_REQUESTED"
-]);
-var STOPPED_BRANCH_STATES = /* @__PURE__ */ new Set([
-  "BLOCKED",
-  "MERGED",
-  "CLOSED",
-  "CANCELED",
-  "CLOSE_REQUESTED"
-]);
-function branchStoppedByFailure(branch) {
-  const failure = branch.failure;
-  if (failure === null) {
-    return false;
-  }
-  return failure.code === "REPOSITORY_CHANGED" || branch.pullRequest === null && !failure.retryable;
-}
-function isSettled(pullRequest) {
-  if (!SETTLED_STATES.has(pullRequest.state)) {
-    return false;
-  }
-  const branch = pullRequest.branch;
-  if (pullRequest.state === "OPEN" && branch) {
-    return branch.pullRequest?.state === "OPEN" || STOPPED_BRANCH_STATES.has(branch.state) || branchStoppedByFailure(branch);
-  }
-  return true;
-}
-var PullRequestWaitDeadline = class extends Error {
-  constructor() {
-    super("the wait for the pull request reached its deadline");
-    this.name = "PullRequestWaitDeadline";
-  }
-};
-function deadlineSignal(ms) {
-  const controller = new AbortController();
-  const timer = setTimeout(
-    () => controller.abort(new PullRequestWaitDeadline()),
-    ms
-  );
-  return { signal: controller.signal, clear: () => clearTimeout(timer) };
-}
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function waitForPullRequest(client, projectId, snapshotId, options = {}) {
-  const deadline = Date.now() + PULL_REQUEST_WAIT_MS;
-  let last2 = null;
-  for (; ; ) {
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) {
-      return { kind: "timed_out", pullRequest: last2 };
-    }
-    const expiry = deadlineSignal(remaining);
-    let pullRequest;
-    try {
-      pullRequest = await client.instructions.getProposalPullRequest(
-        projectId,
-        snapshotId,
-        { org: options.org, signal: expiry.signal }
-      );
-    } catch (error) {
-      if (expiry.signal.aborted) {
-        return { kind: "timed_out", pullRequest: last2 };
-      }
-      throw error;
-    } finally {
-      expiry.clear();
-    }
-    if (pullRequest === null) {
-      return { kind: "none" };
-    }
-    options.observe?.(pullRequest);
-    if (isSettled(pullRequest)) {
-      return { kind: "settled", pullRequest };
-    }
-    last2 = pullRequest;
-    if (deadline - Date.now() <= PULL_REQUEST_POLL_MS) {
-      return { kind: "timed_out", pullRequest: last2 };
-    }
-    await delay(PULL_REQUEST_POLL_MS);
-  }
-}
-function splitMessage(message) {
-  const [title = "", ...rest] = message.replace(/\r\n?/g, "\n").split("\n");
-  const body = rest.join("\n").replace(/^\n+/, "");
-  return body === "" ? { title } : { title, body };
-}
-
-// src/lib/instructions/push.ts
-import { createHash as createHash12 } from "crypto";
-var MAX_PUSH_CHANGES = 50;
-var MAX_INLINE_PUSH_BYTES = 2 * 1024 * 1024;
-function assertPushablePath(candidate, source) {
-  const check = checkRelativePath(candidate);
-  if (!check.ok) {
-    throw new Error(
-      `Refusing to push: ${describeRejection(check)}. ${source}`
-    );
-  }
-  if (isReservedPath(candidate)) {
-    throw new Error(
-      `Refusing to push: ${describeRejection({
-        ok: false,
-        reason: "reserved_path",
-        detail: candidate
-      })}. ${source}`
-    );
-  }
-}
-function encodeContent(bytes) {
-  const text3 = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
-  const roundTrip = new TextEncoder().encode(text3);
-  if (roundTrip.length === bytes.length && roundTrip.every((byte, index) => byte === bytes[index])) {
-    return { content: text3, encoding: "utf8" };
-  }
-  return {
-    content: Buffer.from(bytes).toString("base64"),
-    encoding: "base64"
-  };
-}
-function sha256Of(bytes) {
-  return createHash12("sha256").update(bytes).digest("hex");
-}
-function refuseStaleLedger(detail) {
-  throw new Error(
-    `Refusing to push: the sync lock does not match the published version \u2014 ${detail}. Run \`${fabricCommand("instructions sync")}\` and try again. Nothing was read and nothing was sent.`
-  );
-}
-function assertLockMatchesManifest(lock, manifest) {
-  const published = new Map(
-    manifest.map((entry) => [entry.path, entry.sha256])
-  );
-  for (const [path29, entry] of Object.entries(lock.files)) {
-    const expected = published.get(path29);
-    if (expected === void 0) {
-      refuseStaleLedger(
-        `it lists ${path29}, which version ${lock.snapshotVersion} does not contain`
-      );
-    }
-    if (expected !== entry.sha256) {
-      refuseStaleLedger(
-        `its record of ${path29} is not the published file`
-      );
-    }
-  }
-  for (const entry of manifest) {
-    if (!Object.hasOwn(lock.files, entry.path)) {
-      refuseStaleLedger(
-        `version ${lock.snapshotVersion} contains ${entry.path}, which the lock does not list`
-      );
-    }
+  for (const entry of manifest) {
+    if (!Object.hasOwn(lock.files, entry.path)) {
+      refuseStaleLedger(
+        `version ${lock.snapshotVersion} contains ${entry.path}, which the lock does not list`
+      );
+    }
   }
 }
 async function computePushPlan(input) {
@@ -14501,95 +14863,731 @@ async function computePushPlan(input) {
       sha256: fingerprint.sha256
     });
   }
-  return { entries, unchanged };
+  return { entries, unchanged };
+}
+function pushContentBytes(entries) {
+  return entries.reduce(
+    (total, entry) => total + (entry.action === "put" ? entry.size : 0),
+    0
+  );
+}
+async function materializePushChanges(input) {
+  if (input.entries.length > MAX_PUSH_CHANGES) {
+    throw new Error(`Too many changes to push (${input.entries.length}).`);
+  }
+  if (pushContentBytes(input.entries) > MAX_INLINE_PUSH_BYTES) {
+    throw new Error("The selected changes are too large to send inline.");
+  }
+  const changes = [];
+  for (const entry of input.entries) {
+    if (entry.action === "delete") {
+      const current = await readFileSafely(input.root, entry.path, {
+        maxBytes: 0
+      });
+      if (current !== null) {
+        throw new Error(
+          `Refusing to push: ${entry.path} reappeared after planning. Plan the changes again.`
+        );
+      }
+      changes.push({ op: "delete", path: entry.path });
+      continue;
+    }
+    const read = await readFileSafely(input.root, entry.path, {
+      maxBytes: MAX_INLINE_PUSH_BYTES
+    });
+    if (read === null) {
+      throw new Error(
+        `Refusing to push: ${entry.path} disappeared after planning. Run \`${fabricCommand("instructions push")}\` again.`
+      );
+    }
+    const sha256 = sha256Of(read.bytes);
+    if (read.bytes.length !== entry.size || sha256 !== entry.sha256) {
+      throw new Error(
+        `Refusing to push: ${entry.path} changed after planning. Run \`${fabricCommand("instructions push")}\` again.`
+      );
+    }
+    changes.push({
+      op: "put",
+      path: entry.path,
+      ...encodeContent(read.bytes)
+    });
+  }
+  return changes;
+}
+var LIVE_PULL_REQUEST_STATES = /* @__PURE__ */ new Set([
+  "QUEUED",
+  "OPENING",
+  "OPEN"
+]);
+var LIVE_SNAPSHOT_STATUSES = /* @__PURE__ */ new Set([
+  "VALIDATING",
+  "READY"
+]);
+function carryingProposals(proposals, base) {
+  return proposals.filter(
+    (proposal) => (typeof base === "string" ? proposal.kind !== "native" && proposal.baseSnapshotId === base : proposal.kind === "native" && proposal.nativeBase.generation === base.generation && proposal.nativeBase.commitSha === base.commitSha) && LIVE_SNAPSHOT_STATUSES.has(proposal.status) && (proposal.pullRequest === null || LIVE_PULL_REQUEST_STATES.has(proposal.pullRequest.state))
+  ).sort(
+    (a, b) => a.kind === "native" || b.kind === "native" ? 0 : b.version - a.version
+  );
+}
+function setAsideProposed(plan, proposals, base) {
+  const carrying = carryingProposals(proposals, base);
+  const carriedBy = (entry) => carrying.find(
+    (proposal) => proposal.changes.some(
+      (change) => change.path === entry.path && change.op === entry.action && (entry.action === "delete" || change.sha256 === entry.sha256)
+    )
+  );
+  const setAside = /* @__PURE__ */ new Set();
+  const alreadyProposed = [];
+  for (const entry of plan.entries) {
+    const proposal = carriedBy(entry);
+    if (proposal === void 0) {
+      continue;
+    }
+    setAside.add(entry.path);
+    alreadyProposed.push({
+      path: entry.path,
+      action: entry.action,
+      proposal: {
+        snapshotId: proposal.kind === "native" ? proposal.operationId : proposal.snapshotId,
+        version: proposal.kind === "native" ? null : proposal.version,
+        pullRequest: proposal.pullRequest
+      }
+    });
+  }
+  return {
+    plan: {
+      entries: plan.entries.filter((entry) => !setAside.has(entry.path)),
+      unchanged: plan.unchanged
+    },
+    alreadyProposed
+  };
+}
+
+// src/lib/instructions/native-push-plan.ts
+async function computeNativePushPlan(input) {
+  const allowed = new Set(input.files.map((file) => file.path));
+  const selected = new Set(
+    input.changedPaths.filter((file) => allowed.has(file))
+  );
+  for (const file of input.added ?? []) {
+    assertPushablePath(file, "That path cannot be pushed.");
+    if (!allowed.has(file)) selected.add(file);
+  }
+  if (selected.size > MAX_PUSH_CHANGES) {
+    throw new Error(
+      `Too many changes to push (${selected.size} > ${MAX_PUSH_CHANGES}). Select a smaller change set.`
+    );
+  }
+  const collision = findCollision([.../* @__PURE__ */ new Set([...allowed, ...selected])]);
+  if (collision !== null) {
+    throw new Error(
+      `Refusing to push colliding paths: ${collision.first} and ${collision.second}.`
+    );
+  }
+  const entries = [];
+  let totalBytes = 0;
+  for (const file of [...selected].sort()) {
+    assertPushablePath(file, "That path cannot be pushed.");
+    const read = await readFileSafely(input.root, file, {
+      maxBytes: MAX_INLINE_PUSH_BYTES - totalBytes
+    });
+    if (read === null) {
+      if (!allowed.has(file))
+        throw new Error(
+          `Refusing to push: there is no file at ${file}.`
+        );
+      entries.push({ path: file, action: "delete" });
+    } else {
+      totalBytes += read.bytes.length;
+      entries.push({
+        path: file,
+        action: "put",
+        size: read.bytes.length,
+        sha256: createHash13("sha256").update(read.bytes).digest("hex")
+      });
+    }
+  }
+  return {
+    entries,
+    unchanged: input.files.filter((file) => !selected.has(file.path)).map((file) => file.path)
+  };
+}
+
+// src/lib/instructions/open-proposals.ts
+var openProposalTiming = { deadlineMs: 15e3 };
+var SNAPSHOT_STATUSES = {
+  RECEIVING: true,
+  VALIDATING: true,
+  READY: true,
+  REJECTED: true,
+  FAILED: true
+};
+var PULL_REQUEST_STATES = {
+  QUEUED: true,
+  OPENING: true,
+  OPEN: true,
+  CLOSE_REQUESTED: true,
+  BLOCKED: true,
+  MERGED: true,
+  CLOSED: true,
+  CANCELED: true
+};
+function isKnown(known, value) {
+  return typeof value === "string" && Object.hasOwn(known, value);
+}
+var OpenProposalDeadline = class extends Error {
+  constructor(ms) {
+    super(`it did not answer within ${Math.ceil(ms / 1e3)} s`);
+    this.name = "OpenProposalDeadline";
+  }
+};
+async function lookUpOpenProposals(client, projectId, options = {}) {
+  const ms = openProposalTiming.deadlineMs;
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(new OpenProposalDeadline(ms)),
+    ms
+  );
+  let answer;
+  try {
+    answer = await client.instructions.getOpenProposals(projectId, {
+      org: options.org,
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) {
+      return {
+        kind: "unavailable",
+        reason: describeError(controller.signal.reason)
+      };
+    }
+    if (error.status === 404) {
+      return {
+        kind: "unavailable",
+        reason: "this Fabric server does not list open proposals yet"
+      };
+    }
+    const status = error?.status;
+    return {
+      kind: "unavailable",
+      reason: typeof status === "number" && status > 0 ? `the server answered ${status}` : "the request did not go through"
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!Array.isArray(answer) || !answer.every(isOpenProposal)) {
+    return {
+      kind: "unavailable",
+      reason: "the server's answer was not a list of proposals"
+    };
+  }
+  return { kind: "found", proposals: answer };
+}
+function isOpenProposal(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const proposal = value;
+  const pullRequest = proposal.pullRequest;
+  return (proposal.kind === "native" ? typeof proposal.operationId === "string" && isNativeBase(proposal.nativeBase) : typeof proposal.snapshotId === "string" && typeof proposal.version === "number" && typeof proposal.baseSnapshotId === "string") && isKnown(SNAPSHOT_STATUSES, proposal.status) && (pullRequest === null || typeof pullRequest === "object" && pullRequest !== void 0 && isKnown(PULL_REQUEST_STATES, pullRequest.state) && (pullRequest.url === null || typeof pullRequest.url === "string")) && Array.isArray(proposal.changes) && proposal.changes.every(isChange);
+}
+function isNativeBase(value) {
+  if (typeof value !== "object" || value === null) return false;
+  return "generation" in value && Number.isSafeInteger(value.generation) && typeof value.generation === "number" && value.generation > 0 && "commitSha" in value && typeof value.commitSha === "string" && /^[a-f0-9]{40}$/.test(value.commitSha);
+}
+function isChange(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const change = value;
+  return typeof change.path === "string" && (change.op === "put" && typeof change.sha256 === "string" || change.op === "delete" && change.sha256 === null);
+}
+
+// src/lib/instructions/pull-request-wait.ts
+var PULL_REQUEST_POLL_MS = 2e3;
+var PULL_REQUEST_WAIT_MS = 6e4;
+var SETTLED_STATES = /* @__PURE__ */ new Set([
+  "OPEN",
+  "BLOCKED",
+  "MERGED",
+  "CLOSED",
+  "CANCELED",
+  "CLOSE_REQUESTED"
+]);
+var STOPPED_BRANCH_STATES = /* @__PURE__ */ new Set([
+  "BLOCKED",
+  "MERGED",
+  "CLOSED",
+  "CANCELED",
+  "CLOSE_REQUESTED"
+]);
+function branchStoppedByFailure(branch) {
+  const failure = branch.failure;
+  if (failure === null) {
+    return false;
+  }
+  return failure.code === "REPOSITORY_CHANGED" || branch.pullRequest === null && !failure.retryable;
+}
+function isSettled(pullRequest) {
+  if (!SETTLED_STATES.has(pullRequest.state)) {
+    return false;
+  }
+  const branch = pullRequest.branch;
+  if (pullRequest.state === "OPEN" && branch) {
+    return branch.pullRequest?.state === "OPEN" || STOPPED_BRANCH_STATES.has(branch.state) || branchStoppedByFailure(branch);
+  }
+  return true;
+}
+var PullRequestWaitDeadline = class extends Error {
+  constructor() {
+    super("the wait for the pull request reached its deadline");
+    this.name = "PullRequestWaitDeadline";
+  }
+};
+function deadlineSignal(ms) {
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(new PullRequestWaitDeadline()),
+    ms
+  );
+  return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function waitForPullRequest(client, projectId, snapshotId, options = {}) {
+  const deadline = Date.now() + PULL_REQUEST_WAIT_MS;
+  let last2 = null;
+  for (; ; ) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      return { kind: "timed_out", pullRequest: last2 };
+    }
+    const expiry = deadlineSignal(remaining);
+    let pullRequest;
+    try {
+      pullRequest = await client.instructions.getProposalPullRequest(
+        projectId,
+        snapshotId,
+        { org: options.org, signal: expiry.signal }
+      );
+    } catch (error) {
+      if (expiry.signal.aborted) {
+        return { kind: "timed_out", pullRequest: last2 };
+      }
+      throw error;
+    } finally {
+      expiry.clear();
+    }
+    if (pullRequest === null) {
+      return { kind: "none" };
+    }
+    options.observe?.(pullRequest);
+    if (isSettled(pullRequest)) {
+      return { kind: "settled", pullRequest };
+    }
+    last2 = pullRequest;
+    if (deadline - Date.now() <= PULL_REQUEST_POLL_MS) {
+      return { kind: "timed_out", pullRequest: last2 };
+    }
+    await delay(PULL_REQUEST_POLL_MS);
+  }
+}
+function splitMessage(message) {
+  const [title = "", ...rest] = message.replace(/\r\n?/g, "\n").split("\n");
+  const body = rest.join("\n").replace(/^\n+/, "");
+  return body === "" ? { title } : { title, body };
+}
+
+// src/lib/instructions/pull-request-verdict.ts
+function pushPullRequest(pullRequest, timedOut) {
+  const branch = pullRequest.branch ?? null;
+  return {
+    operationId: pullRequest.operationId,
+    state: pullRequest.state,
+    url: branch?.pullRequest?.url ?? pullRequest.url,
+    failure: pullRequest.failure,
+    timedOut,
+    branch,
+    append: pullRequest.append ?? null
+  };
+}
+var BLOCKED_REASONS = {
+  ATTRIBUTION_REJECTED: "the project's name or your display name looks like an address, a link or a credential, so the commit could not name you safely",
+  PERMISSION_REVOKED: "you no longer have permission to suggest changes to this project's repository",
+  CONFIGURATION_CHANGED: "the project's repository settings changed after you suggested this; push again",
+  TARGET_BRANCH_MISSING: "the repository branch the project syncs from no longer exists",
+  BASE_COMMIT_UNAVAILABLE: "the commit this suggestion was based on is no longer in the repository; sync and push again",
+  TREE_CONFLICT: "the repository changed the same files since your last sync; sync and push again",
+  AUTHENTICATION_FAILED: "the project's repository connection needs to be reconnected",
+  REPOSITORY_UNAVAILABLE: "the repository could not be reached",
+  BRANCH_WRITE_REFUSED: "the repository refused the new branch",
+  PR_CREATION_REFUSED: "the repository refused to open the pull request",
+  REMOTE_REF_CONFLICT: "a branch with the same name already exists in the repository",
+  CREATE_OUTCOME_UNKNOWN: "Fabric could not confirm whether the pull request was created",
+  VALIDATION_TIMEOUT: "the files' checks did not finish in time",
+  LIMITS_EXCEEDED: "the change is larger than Fabric can open as a pull request",
+  PROVIDER_RATE_LIMITED: "the repository's provider is limiting requests",
+  PROVIDER_TEMPORARY: "the repository's provider had a temporary problem",
+  LOOKUP_INCONCLUSIVE: "Fabric could not confirm the pull request's state",
+  // Member proposal branches (Fizzy #2738 spec §9). BRANCH_CONFLICT and
+  // SUPERSEDED_BY_LATER_CHANGE name their paths, in `blockedReason`.
+  BRANCH_MOVED: "your branch kept changing while Fabric was adding to it",
+  BRANCH_NAME_UNAVAILABLE: "Fabric could not reserve a branch name for your pull request; ask an owner to remove old proposal branches",
+  REPOSITORY_CHANGED: "the repository connection now points at another repository, so Fabric can no longer reach your pull request; close it in the repository, then stop tracking it in the Coding Instructions tab",
+  PUSH_OUTCOME_UNKNOWN: "Fabric could not confirm whether this change reached your branch, which may have been changed outside Fabric; check the branch, then try again or withdraw it",
+  BRANCH_MISSING: "your branch was deleted in the repository"
+};
+var FAILURE_PATHS_LISTED = 20;
+function failurePaths(failure) {
+  const paths = failure.params?.paths;
+  const count = failure.params?.count;
+  if (typeof paths !== "string" || paths === "") {
+    return "some of its files";
+  }
+  return typeof count === "number" && count > FAILURE_PATHS_LISTED ? `${paths} and ${count - FAILURE_PATHS_LISTED} more` : paths;
+}
+function blockedReason(failure) {
+  switch (failure.code) {
+    case "BRANCH_CONFLICT":
+      return `files on your branch were changed outside Fabric (${failurePaths(failure)}), and Fabric does not overwrite them while the pull request is open; make this change on your branch in the repository, or wait until the pull request merges`;
+    case "SUPERSEDED_BY_LATER_CHANGE":
+      return `a newer change of yours already edits ${failurePaths(failure)}; use Try again to apply this one on top of it, or withdraw it`;
+    default:
+      return BLOCKED_REASONS[failure.code] ?? `it stopped with ${failure.code}`;
+  }
+}
+function pullRequestVerdict(pullRequest, { waited, openedHere }) {
+  const url = pullRequest.url ? `: ${pullRequest.url}` : "";
+  const branch = pullRequest.branch;
+  if (!waited) {
+    return {
+      text: "Follow its pull request in the project's Coding Instructions tab.",
+      fails: false
+    };
+  }
+  if (pullRequest.timedOut) {
+    return {
+      text: "The pull request is being opened; see the project's Coding Instructions tab.",
+      fails: false
+    };
+  }
+  switch (pullRequest.state) {
+    case "OPEN": {
+      if (!branch) {
+        return { text: `Pull request opened${url}`, fails: false };
+      }
+      if (branch.state === "MERGED") {
+        return {
+          text: `Your pull request was merged${url} while this change was being added to it; see the project's Coding Instructions tab for whether it carried this change.`,
+          fails: false
+        };
+      }
+      if (branch.state === "CLOSED") {
+        return {
+          text: `Your pull request was closed without merging${url} while this change was being added to it.`,
+          fails: false
+        };
+      }
+      if (branch.failure && (branch.state === "BLOCKED" || branchStoppedByFailure(branch))) {
+        const next = branch.failure.retryable ? "Fabric will try again on its own; see" : "See";
+        const what = branch.pullRequest ? `Your change is on your branch, but Fabric can no longer update its pull request${url}` : "Your change is on your branch, but Fabric could not open its pull request";
+        return {
+          text: `${what}: ${blockedReason(branch.failure)}. ${next} the project's Coding Instructions tab.`,
+          fails: true
+        };
+      }
+      if (branch.state === "CLOSE_REQUESTED") {
+        return {
+          text: "Your pull request is being closed, and this change leaves with it; push again once it has closed.",
+          fails: true
+        };
+      }
+      if (branch.state === "CANCELED") {
+        return {
+          text: "Your branch was closed before its pull request opened; push again.",
+          fails: true
+        };
+      }
+      if (branch.pullRequest?.state === "OPEN") {
+        return {
+          text: openedHere ? `Opened pull request ${branch.pullRequest.url}` : `Added to your pull request ${branch.pullRequest.url}`,
+          fails: false
+        };
+      }
+      return {
+        text: "Your change is on your branch and its pull request is being opened; see the project's Coding Instructions tab.",
+        fails: false
+      };
+    }
+    case "MERGED":
+      return {
+        text: `Its pull request was already merged${url}. Run \`${fabricCommand("instructions sync")}\` once the project has synced it.`,
+        fails: false
+      };
+    case "CLOSED":
+      return {
+        text: `Its pull request was closed without merging${url}.`,
+        fails: false
+      };
+    case "CANCELED":
+      if (pullRequest.failure?.code === "ALREADY_ON_BRANCH") {
+        return {
+          text: branch?.pullRequest ? `Already on your branch; nothing to add. Your pull request: ${branch.pullRequest.url}` : "Already on your branch; nothing to add.",
+          fails: false
+        };
+      }
+      return {
+        text: pullRequest.failure?.code === "VALIDATION_REJECTED" ? "The suggestion did not pass Fabric's checks, so no pull request was opened; see the project's Coding Instructions tab." : branch ? "The suggestion was withdrawn before it was added to your pull request." : "The suggestion was withdrawn before a pull request was opened.",
+        fails: true
+      };
+    case "CLOSE_REQUESTED":
+      return {
+        text: "An earlier attempt at this change was withdrawn and its pull request is being closed; push again once it has closed.",
+        fails: true
+      };
+    case "BLOCKED": {
+      const failure = pullRequest.failure ?? branch?.failure ?? null;
+      const reason = failure ? blockedReason(failure) : "it stopped with an unknown failure";
+      const next = failure?.retryable ? "Fabric will try again on its own; see" : "See";
+      const what = branch ? "Fabric could not add this change to your pull request" : "Fabric could not open the pull request";
+      return {
+        text: `${what}: ${reason}. ${next} the project's Coding Instructions tab.`,
+        fails: true
+      };
+    }
+    default:
+      return {
+        text: "The pull request is being opened; see the project's Coding Instructions tab.",
+        fails: false
+      };
+  }
 }
-function pushContentBytes(entries) {
-  return entries.reduce(
-    (total, entry) => total + (entry.action === "put" ? entry.size : 0),
-    0
+
+// src/lib/instructions/native-push.ts
+async function runNativeInstructionPush(input) {
+  if (input.publish)
+    throw new CliFailure(
+      "Repository instructions are changed through Git commits or reviewed suggestions. Run push without --publish to open a suggestion.",
+      2
+    );
+  const deadline = Date.now() + 3e4;
+  const checkout = await classifyCheckout({
+    destination: input.root,
+    repository: input.repository,
+    deadline,
+    remote: input.remote
+  });
+  if (checkout.class !== "matching")
+    throw new CliFailure(
+      "Run this command in the attached repository's instruction folder. No files were sent.",
+      7
+    );
+  const head = await headSha(checkout.toplevel, deadline);
+  if (head.kind !== "ok" || head.value !== input.direct.currentCommitSha) {
+    throw new CliFailure(
+      "This checkout's HEAD does not match the repository revision read through Fabric. Update the checkout before proposing working-tree changes. Local edits were preserved.",
+      7
+    );
+  }
+  const operation = await operationInProgress(
+    checkout.toplevel,
+    deadline
   );
-}
-async function materializePushChanges(input) {
-  if (input.entries.length > MAX_PUSH_CHANGES) {
-    throw new Error(`Too many changes to push (${input.entries.length}).`);
+  if (operation.kind !== "ok" || operation.value !== null) {
+    throw new CliFailure(
+      "Finish the current Git operation before proposing changes. No files were sent.",
+      7
+    );
   }
-  if (pushContentBytes(input.entries) > MAX_INLINE_PUSH_BYTES) {
-    throw new Error("The selected changes are too large to send inline.");
+  const changed = await changedTrackedPaths(input.root, deadline);
+  if (changed.kind !== "ok")
+    throw new CliFailure(
+      "Git could not list this checkout's changes. No files were sent.",
+      7
+    );
+  const nativeBase = {
+    generation: input.direct.generation,
+    commitSha: input.direct.currentCommitSha
+  };
+  const listed = await input.client.instructions.listRepositoryFiles(
+    input.projectId,
+    { ...nativeBase, org: input.org }
+  );
+  if (listed.generation !== nativeBase.generation || listed.commitSha !== nativeBase.commitSha || listed.incomplete || listed.refusal !== null) {
+    throw new CliFailure(
+      "The repository tree could not be read completely at the selected revision. Refresh and try again; no files were sent.",
+      7
+    );
   }
-  const changes = [];
-  for (const entry of input.entries) {
-    if (entry.action === "delete") {
-      changes.push({ op: "delete", path: entry.path });
-      continue;
+  let plan = await computeNativePushPlan({
+    root: input.root,
+    files: listed.files,
+    changedPaths: changed.value,
+    added: input.add
+  });
+  if (plan.entries.length === 0)
+    throw new CliFailure(
+      "Nothing to push: Git reports no instruction content changes. Add a new file with --add <path>.",
+      7
+    );
+  let alreadyProposed = [];
+  let openProposalCheck = "skipped";
+  if (!input.includeProposed) {
+    const lookup = await lookUpOpenProposals(
+      input.client,
+      input.projectId,
+      { org: input.org }
+    );
+    if (lookup.kind === "found") {
+      ({ plan, alreadyProposed } = setAsideProposed(
+        plan,
+        lookup.proposals,
+        nativeBase
+      ));
+      openProposalCheck = "checked";
+    } else {
+      openProposalCheck = "unavailable";
+      process.stderr.write(
+        `Could not check your open proposals (${lookup.reason}); the selected changes will be sent.
+`
+      );
     }
-    const read = await readFileSafely(input.root, entry.path, {
-      maxBytes: MAX_INLINE_PUSH_BYTES
+  }
+  const outcome = {
+    projectId: input.projectId,
+    destination: input.root,
+    nativeBase,
+    dryRun: Boolean(input.dryRun),
+    put: plan.entries.filter((entry) => entry.action === "put").map((entry) => entry.path),
+    deleted: plan.entries.filter((entry) => entry.action === "delete").map((entry) => entry.path),
+    unchanged: plan.unchanged.length,
+    openProposalCheck,
+    alreadyProposed: alreadyProposed.map((entry) => ({
+      path: entry.path,
+      operationId: entry.proposal.snapshotId,
+      pullRequestUrl: entry.proposal.pullRequest?.url ?? null
+    })),
+    operationId: null,
+    pullRequest: null,
+    timedOut: false
+  };
+  let sawBranchWithoutPullRequest = false;
+  if (!input.dryRun && plan.entries.length > 0) {
+    const changes = await materializePushChanges({
+      root: input.root,
+      entries: plan.entries
     });
-    if (read === null) {
-      throw new Error(
-        `Refusing to push: ${entry.path} disappeared after planning. Run \`${fabricCommand("instructions push")}\` again.`
+    const currentHead = await headSha(checkout.toplevel, deadline);
+    if (currentHead.kind !== "ok" || currentHead.value !== nativeBase.commitSha)
+      throw new CliFailure(
+        "HEAD changed while planning. No files were sent; run push again.",
+        7
       );
+    const submitted = await input.client.instructions.submitRepositoryChange(
+      input.projectId,
+      nativeBase,
+      changes,
+      {
+        org: input.org,
+        ...input.message === void 0 ? {} : { note: splitMessage(input.message) }
+      }
+    );
+    outcome.operationId = submitted.operationId;
+    if (input.wait !== false) {
+      try {
+        const waited = await waitForPullRequest(
+          input.client,
+          input.projectId,
+          submitted.operationId,
+          {
+            org: input.org,
+            observe: (status) => {
+              if (status.branch && status.branch.pullRequest === null)
+                sawBranchWithoutPullRequest = true;
+            }
+          }
+        );
+        if (waited.kind !== "none") {
+          outcome.pullRequest = waited.pullRequest ? pushPullRequest(
+            waited.pullRequest,
+            waited.kind === "timed_out"
+          ) : null;
+          outcome.timedOut = waited.kind === "timed_out";
+        }
+      } catch (error) {
+        throw new CliFailure(
+          `Suggestion ${submitted.operationId} was accepted, but its pull request could not be checked: ${describeError(error)}. Check the project's Coding Instructions tab.`,
+          7
+        );
+      }
     }
-    const sha256 = sha256Of(read.bytes);
-    if (read.bytes.length !== entry.size || sha256 !== entry.sha256) {
-      throw new Error(
-        `Refusing to push: ${entry.path} changed after planning. Run \`${fabricCommand("instructions push")}\` again.`
+  }
+  const verdict = outcome.pullRequest ? pullRequestVerdict(outcome.pullRequest, {
+    waited: input.wait !== false,
+    openedHere: sawBranchWithoutPullRequest
+  }) : null;
+  if (input.format === "json") printOutput(outcome, { format: "json" });
+  else {
+    if (input.dryRun)
+      process.stdout.write(
+        `Would suggest ${plan.entries.length} changes against Git ${nativeBase.commitSha.slice(0, 7)}.
+`
       );
-    }
-    changes.push({
-      op: "put",
-      path: entry.path,
-      ...encodeContent(read.bytes)
-    });
+    else if (outcome.operationId)
+      process.stdout.write(
+        `Suggestion accepted: ${outcome.operationId}.
+`
+      );
+    else
+      process.stdout.write(
+        "These changes are already in your open suggestions.\n"
+      );
+    for (const entry of plan.entries)
+      process.stdout.write(`  ${entry.action} ${entry.path}
+`);
+    if (verdict && !verdict.fails)
+      process.stdout.write(`${verdict.text}
+`);
   }
-  return changes;
+  if (verdict?.fails) throw new CliFailure(verdict.text, 7);
 }
-var LIVE_PULL_REQUEST_STATES = /* @__PURE__ */ new Set([
-  "QUEUED",
-  "OPENING",
-  "OPEN"
-]);
-var LIVE_SNAPSHOT_STATUSES = /* @__PURE__ */ new Set([
-  "VALIDATING",
-  "READY"
-]);
-function carryingProposals(proposals, baseSnapshotId) {
-  return proposals.filter(
-    (proposal) => proposal.baseSnapshotId === baseSnapshotId && LIVE_SNAPSHOT_STATUSES.has(proposal.status) && (proposal.pullRequest === null || LIVE_PULL_REQUEST_STATES.has(proposal.pullRequest.state))
-  ).sort((a, b) => b.version - a.version);
+
+// src/lib/instructions/prompt.ts
+import { createInterface as createInterface2 } from "readline/promises";
+function canPrompt(streams = {
+  stdin: process.stdin,
+  stderr: process.stderr
+}) {
+  return streams.stdin?.isTTY === true && streams.stderr?.isTTY === true;
 }
-function setAsideProposed(plan, proposals, baseSnapshotId) {
-  const carrying = carryingProposals(proposals, baseSnapshotId);
-  const carriedBy = (entry) => carrying.find(
-    (proposal) => proposal.changes.some(
-      (change) => change.path === entry.path && change.op === entry.action && (entry.action === "delete" || change.sha256 === entry.sha256)
-    )
+async function ask(question, streams) {
+  const reader = createInterface2({
+    input: streams.input,
+    output: streams.output
+  });
+  try {
+    return (await reader.question(question)).trim();
+  } finally {
+    reader.close();
+  }
+}
+async function chooseProject(projects, streams = { input: process.stdin, output: process.stderr }) {
+  streams.output.write(
+    `This repository is connected to ${projects.length} projects:
+`
   );
-  const setAside = /* @__PURE__ */ new Set();
-  const alreadyProposed = [];
-  for (const entry of plan.entries) {
-    const proposal = carriedBy(entry);
-    if (proposal === void 0) {
-      continue;
-    }
-    setAside.add(entry.path);
-    alreadyProposed.push({
-      path: entry.path,
-      action: entry.action,
-      proposal: {
-        snapshotId: proposal.snapshotId,
-        version: proposal.version,
-        pullRequest: proposal.pullRequest
-      }
-    });
+  for (const [index, project] of projects.entries()) {
+    streams.output.write(`  [${index + 1}] ${project.label}
+`);
   }
-  return {
-    plan: {
-      entries: plan.entries.filter((entry) => !setAside.has(entry.path)),
-      unchanged: plan.unchanged
-    },
-    alreadyProposed
-  };
+  const answer = await ask(`Which one? [1-${projects.length}] `, streams);
+  const number = /^\d+$/.test(answer) ? Number(answer) : 0;
+  return number >= 1 && number <= projects.length ? number - 1 : null;
+}
+async function confirm(question, streams = { input: process.stdin, output: process.stderr }) {
+  return /^y(es)?$/i.test(await ask(`${question} [y/N] `, streams));
 }
 
 // src/lib/instructions/resolve-project.ts
@@ -14685,8 +15683,8 @@ async function resolveProjectFromCheckout(input) {
 }
 
 // src/lib/instructions/self-update.ts
-import { createHash as createHash13 } from "crypto";
-import { mkdir as mkdir9, readFile as readFile8, realpath as realpath5, writeFile as writeFile5 } from "fs/promises";
+import { createHash as createHash14 } from "crypto";
+import { mkdir as mkdir10, readFile as readFile9, realpath as realpath5, writeFile as writeFile6 } from "fs/promises";
 import path26 from "path";
 
 // src/lib/instructions/npm-tarball.ts
@@ -14830,7 +15828,7 @@ async function isKeptCopy(script, copy) {
 }
 async function readState2(file) {
   try {
-    const parsed = JSON.parse(await readFile8(file, "utf8"));
+    const parsed = JSON.parse(await readFile9(file, "utf8"));
     return typeof parsed.checkedAt === "number" && Number.isFinite(parsed.checkedAt) && typeof parsed.tarball === "string" ? { checkedAt: parsed.checkedAt, tarball: parsed.tarball } : null;
   } catch {
     return null;
@@ -14838,8 +15836,8 @@ async function readState2(file) {
 }
 async function writeState(file, state) {
   try {
-    await mkdir9(path26.dirname(file), { recursive: true });
-    await writeFile5(file, `${JSON.stringify(state)}
+    await mkdir10(path26.dirname(file), { recursive: true });
+    await writeFile6(file, `${JSON.stringify(state)}
 `);
     return true;
   } catch {
@@ -14957,7 +15955,7 @@ async function attempt({
     signal,
     fetchImpl
   );
-  const digest = `sha512-${createHash13("sha512").update(tarball).digest("base64")}`;
+  const digest = `sha512-${createHash14("sha512").update(tarball).digest("base64")}`;
   if (digest !== served.integrity) {
     throw new SelfUpdateFailure(
       "the download does not match the integrity hash the deployment published"
@@ -15081,7 +16079,7 @@ var PROJECT_HELP = "Project ID (default: the project this checkout's repository
 var BASE_URL_HELP = "Deployment to talk to, such as https://example.com (default: the one you are signed in to)";
 var REMOTE_HELP = "Use this remote of the checkout (default: whichever fetches from the project's repository)";
 function buildInstructionsCommand() {
-  const instructions = new Command12("instructions").description(
+  const instructions = new Command13("instructions").description(
     "Keep a checkout current with a project's published coding instructions"
   );
   instructions.command("check").description(
@@ -15417,6 +16415,70 @@ Waiting up to 5 minutes for the sign-in to finish.
     });
   }
 }
+async function ensureRepositoryTransportScope(opts, client) {
+  let scopes;
+  try {
+    scopes = (await client.auth.whoami()).scopes;
+  } catch (error) {
+    throw fixedFailure(error);
+  }
+  if (scopes.includes(REPOSITORY_TRANSPORT_SCOPE)) {
+    return;
+  }
+  if (opts.hook || runningInCi()) {
+    throw new CliFailure(
+      "This repository checkout needs the repositories:read capability. Run instructions init interactively to approve it, or use a CI API key with instructions:read and repositories:read from your organization's API keys settings.",
+      7
+    );
+  }
+  const origin = deploymentOrigin(opts);
+  try {
+    await signInWithBrowser({
+      baseUrl: opts.baseUrl ?? getBaseUrl() ?? origin,
+      origin,
+      explicit: opts.baseUrl !== void 0,
+      project: opts.project,
+      scopes: [...REQUESTED_SCOPES, REPOSITORY_TRANSPORT_SCOPE],
+      signal: AbortSignal.timeout(SIGN_IN_TIMEOUT_MS),
+      announce: (url) => {
+        process.stderr.write(
+          `Opening your browser to approve repository access at ${origin}.
+If it does not open, visit:
+
+  ${url}
+
+Waiting up to 5 minutes for the sign-in to finish.
+
+`
+        );
+      }
+    });
+  } catch {
+    throw new CliFailure(
+      "Repository access was not approved; the native checkout was left unchanged.",
+      7
+    );
+  }
+}
+async function directGitTransport(opts, direct) {
+  if (direct.gitGateway?.version !== "v1") {
+    throw new CliFailure(
+      "This Fabric deployment does not support repository Git transport yet. Update Fabric, then run init again.",
+      7
+    );
+  }
+  const origin = deploymentOrigin(opts);
+  const base = new URL(
+    `/api/v1/projects/${encodeURIComponent(opts.project)}/instructions/repository/git/${direct.generation}`,
+    origin
+  );
+  const signal = opts.hook ? AbortSignal.timeout(hookDeadlineMs()) : void 0;
+  const token = getOAuth(origin, opts.project) ? await projectAccessToken(origin, opts.project, signal) : getApiKey(origin, opts.project);
+  if (!token) {
+    throw new NotSignedInError(origin, opts.project);
+  }
+  return { url: base.toString(), authorization: `Bearer ${token}` };
+}
 function hasSignInFor(origin, project) {
   if (project === void 0) {
     return Boolean(getApiKey(origin));
@@ -15528,6 +16590,7 @@ var SourceGuard = class {
 };
 function sourceIdentity(published) {
   const repository = published.repository ?? null;
+  const direct = directRepositoryRead(published);
   return JSON.stringify([
     published.sourceOfTruth,
     repository === null ? null : [
@@ -15537,9 +16600,61 @@ function sourceIdentity(published) {
       repository.ref,
       repository.rootPath,
       repository.generation
-    ]
+    ],
+    direct === null ? null : [direct.generation, direct.currentCommitSha]
   ]);
 }
+function directRepositoryRead(published) {
+  const direct = published.direct;
+  return published.sourceOfTruth === "REPOSITORY" && published.repository !== void 0 && published.repository !== null && direct?.availability === "READY" ? direct : null;
+}
+async function directRepositoryCheckoutStatus(input) {
+  const commit = input.direct.currentCommitSha.slice(0, 7);
+  const repository = repositoryName(input.repository);
+  if (input.checkout.class !== "matching") {
+    return {
+      current: false,
+      line: `Coding instructions are read directly from ${repository} at ${commit}. Open a matching native checkout before reading them locally.`
+    };
+  }
+  const head = input.report.state?.head;
+  if (head === null || head === void 0) {
+    return {
+      current: false,
+      line: `Coding instructions are read directly from ${repository} at ${commit}; this checkout could not be compared to that commit.`
+    };
+  }
+  const contains = await isAncestor(
+    input.checkout.toplevel,
+    input.direct.currentCommitSha,
+    head,
+    gitDeadline()
+  );
+  if (contains.kind === "ok" && contains.value) {
+    return {
+      current: true,
+      line: `Coding instructions are read directly from ${repository} at ${commit}; this checkout already contains that commit.`
+    };
+  }
+  if (contains.kind === "ok") {
+    const behind = await isAncestor(
+      input.checkout.toplevel,
+      head,
+      input.direct.currentCommitSha,
+      gitDeadline()
+    );
+    if (behind.kind === "ok") {
+      return {
+        current: false,
+        line: behind.value ? `Coding instructions are read directly from ${repository} at ${commit}; this checkout is behind. Run git pull --ff-only.` : `Coding instructions are read directly from ${repository} at ${commit}; this checkout has diverged. Inspect its Git history before choosing how to update it.`
+      };
+    }
+  }
+  return {
+    current: false,
+    line: `Coding instructions are read directly from ${repository} at ${commit}; fetch that commit with your normal Git remote before continuing.`
+  };
+}
 async function readLockForProject2(destination, projectId) {
   const lock = await readLock(destination);
   if (lock !== null && lock.projectId !== projectId) {
@@ -15609,6 +16724,35 @@ async function runCheck(opts, format) {
     snapshot: published.snapshot,
     deadline: gitDeadline()
   });
+  const direct = directRepositoryRead(published);
+  if (direct !== null && published.repository) {
+    const status = await directRepositoryCheckoutStatus({
+      repository: published.repository,
+      direct,
+      checkout: guard.checkout ?? { class: "not-git" },
+      report: checkout ?? await reportForClassification({
+        classification: { class: "not-git" },
+        repository: published.repository,
+        snapshot: void 0,
+        deadline: gitDeadline()
+      })
+    });
+    if (format === "json") {
+      printOutput(
+        {
+          projectId: opts.project,
+          destination,
+          direct,
+          checkout: checkout?.json ?? null
+        },
+        { format: "json" }
+      );
+    } else if (!opts.hook || !status.current) {
+      process.stdout.write(`${status.line}
+`);
+    }
+    return;
+  }
   if (opts.hook && format !== "json" && checkout !== null && checkout.classification.class !== "not-git") {
     if (checkout.line !== null) {
       line(checkout.line);
@@ -15866,6 +17010,57 @@ async function syncOnce(opts) {
   const guard = opts.guard ?? new SourceGuard(destination, opts.remote);
   const hint = await lockDigestHint(existing, opts.project);
   let published = await fetchPublished(client, opts, hint, guard);
+  const direct = directRepositoryRead(published);
+  const directRepository = published.repository;
+  if (direct !== null) {
+    if (guard.checkout === null || guard.checkout.class !== "matching" || directRepository === null || directRepository === void 0) {
+      throw new CliFailure(
+        "This project reads coding instructions directly from its configured repository. Fabric does not copy them into this folder; open a matching native checkout or rerun init with --clone.",
+        7
+      );
+    }
+    const report = await reportForClassification({
+      classification: guard.checkout,
+      repository: directRepository,
+      snapshot: void 0,
+      deadline: gitDeadline()
+    });
+    const status = await directRepositoryCheckoutStatus({
+      repository: directRepository,
+      direct,
+      checkout: guard.checkout,
+      report
+    });
+    const gitTransport = opts.hook && direct.gitGateway?.version === "v1" ? await directGitTransport(opts, direct) : void 0;
+    const fastForward = opts.hook && guard.checkout.class === "matching" ? await runFastForward({
+      classification: guard.checkout,
+      repository: directRepository,
+      snapshot: void 0,
+      directCommitSha: direct.currentCommitSha,
+      ...gitTransport === void 0 ? {} : { gitTransport },
+      report: {
+        ...report,
+        reportKind: status.current ? "current" : "behind",
+        line: status.current ? null : status.line
+      },
+      projectId: opts.project,
+      deadline: gitDeadline(),
+      optedOut: opts.fastForward === false,
+      traceFile: traceFile(path28.dirname(getConfigPath()))
+    }) : null;
+    return {
+      kind: "reported",
+      destination: existing,
+      published: false,
+      version: null,
+      checkout: {
+        ...report.json,
+        line: status.current ? null : status.line
+      },
+      current: status.current ? status.line : null,
+      fastForward
+    };
+  }
   if (guard.checkout !== null && !downloadsIn(guard.checkout, !opts.hook)) {
     const refused = opts.hook ? null : refuseManualSync(guard.checkout, published.repository);
     if (refused !== null) {
@@ -16141,6 +17336,25 @@ async function runPush2(opts, format) {
   const note = opts.message !== void 0 ? splitMessage(opts.message) : void 0;
   const destination = destinationOf(opts);
   const root = await resolveExistingRoot(destination);
+  const client = instructionsClient(
+    { ...opts, hook: false },
+    PUSH_TIMEOUT_MS2
+  );
+  const published = await fetchPublished(client, opts);
+  const direct = directRepositoryRead(published);
+  if (direct && published.repository) {
+    await runNativeInstructionPush({
+      ...opts,
+      client,
+      projectId: opts.project,
+      root,
+      repository: published.repository,
+      direct,
+      org: orgSlugFor(opts),
+      format
+    });
+    return;
+  }
   const lock = await readLockForProject2(root, opts.project);
   if (lock === null) {
     throw new CliFailure(
@@ -16148,11 +17362,6 @@ async function runPush2(opts, format) {
       7
     );
   }
-  const client = instructionsClient(
-    { ...opts, hook: false },
-    PUSH_TIMEOUT_MS2
-  );
-  const published = await fetchPublished(client, opts);
   if (!published.published || !published.snapshot) {
     throw new CliFailure(
       "this project has no published coding instructions to change yet; the first version is uploaded from the Coding Instructions tab",
@@ -16328,169 +17537,6 @@ async function runPush2(opts, format) {
     throw new CliFailure(verdict.text, 7);
   }
 }
-function pushPullRequest(pullRequest, timedOut) {
-  const branch = pullRequest.branch ?? null;
-  return {
-    operationId: pullRequest.operationId,
-    state: pullRequest.state,
-    url: branch?.pullRequest?.url ?? pullRequest.url,
-    failure: pullRequest.failure,
-    timedOut,
-    branch,
-    append: pullRequest.append ?? null
-  };
-}
-var BLOCKED_REASONS = {
-  ATTRIBUTION_REJECTED: "the project's name or your display name looks like an address, a link or a credential, so the commit could not name you safely",
-  PERMISSION_REVOKED: "you no longer have permission to suggest changes to this project's repository",
-  CONFIGURATION_CHANGED: "the project's repository settings changed after you suggested this; push again",
-  TARGET_BRANCH_MISSING: "the repository branch the project syncs from no longer exists",
-  BASE_COMMIT_UNAVAILABLE: "the commit this suggestion was based on is no longer in the repository; sync and push again",
-  TREE_CONFLICT: "the repository changed the same files since your last sync; sync and push again",
-  AUTHENTICATION_FAILED: "the project's repository connection needs to be reconnected",
-  REPOSITORY_UNAVAILABLE: "the repository could not be reached",
-  BRANCH_WRITE_REFUSED: "the repository refused the new branch",
-  PR_CREATION_REFUSED: "the repository refused to open the pull request",
-  REMOTE_REF_CONFLICT: "a branch with the same name already exists in the repository",
-  CREATE_OUTCOME_UNKNOWN: "Fabric could not confirm whether the pull request was created",
-  VALIDATION_TIMEOUT: "the files' checks did not finish in time",
-  LIMITS_EXCEEDED: "the change is larger than Fabric can open as a pull request",
-  PROVIDER_RATE_LIMITED: "the repository's provider is limiting requests",
-  PROVIDER_TEMPORARY: "the repository's provider had a temporary problem",
-  LOOKUP_INCONCLUSIVE: "Fabric could not confirm the pull request's state",
-  // Member proposal branches (Fizzy #2738 spec §9). BRANCH_CONFLICT and
-  // SUPERSEDED_BY_LATER_CHANGE name their paths, in `blockedReason`.
-  BRANCH_MOVED: "your branch kept changing while Fabric was adding to it",
-  BRANCH_NAME_UNAVAILABLE: "Fabric could not reserve a branch name for your pull request; ask an owner to remove old proposal branches",
-  REPOSITORY_CHANGED: "the repository connection now points at another repository, so Fabric can no longer reach your pull request; close it in the repository, then stop tracking it in the Coding Instructions tab",
-  PUSH_OUTCOME_UNKNOWN: "Fabric could not confirm whether this change reached your branch, which may have been changed outside Fabric; check the branch, then try again or withdraw it",
-  BRANCH_MISSING: "your branch was deleted in the repository"
-};
-var FAILURE_PATHS_LISTED = 20;
-function failurePaths(failure) {
-  const paths = failure.params?.paths;
-  const count = failure.params?.count;
-  if (typeof paths !== "string" || paths === "") {
-    return "some of its files";
-  }
-  return typeof count === "number" && count > FAILURE_PATHS_LISTED ? `${paths} and ${count - FAILURE_PATHS_LISTED} more` : paths;
-}
-function blockedReason(failure) {
-  switch (failure.code) {
-    case "BRANCH_CONFLICT":
-      return `files on your branch were changed outside Fabric (${failurePaths(failure)}), and Fabric does not overwrite them while the pull request is open; make this change on your branch in the repository, or wait until the pull request merges`;
-    case "SUPERSEDED_BY_LATER_CHANGE":
-      return `a newer change of yours already edits ${failurePaths(failure)}; use Try again to apply this one on top of it, or withdraw it`;
-    default:
-      return BLOCKED_REASONS[failure.code] ?? `it stopped with ${failure.code}`;
-  }
-}
-function pullRequestVerdict(pullRequest, { waited, openedHere }) {
-  const url = pullRequest.url ? `: ${pullRequest.url}` : "";
-  const branch = pullRequest.branch;
-  if (!waited) {
-    return {
-      text: "Follow its pull request in the project's Coding Instructions tab.",
-      fails: false
-    };
-  }
-  if (pullRequest.timedOut) {
-    return {
-      text: "The pull request is being opened; see the project's Coding Instructions tab.",
-      fails: false
-    };
-  }
-  switch (pullRequest.state) {
-    case "OPEN": {
-      if (!branch) {
-        return { text: `Pull request opened${url}`, fails: false };
-      }
-      if (branch.state === "MERGED") {
-        return {
-          text: `Your pull request was merged${url} while this change was being added to it; see the project's Coding Instructions tab for whether it carried this change.`,
-          fails: false
-        };
-      }
-      if (branch.state === "CLOSED") {
-        return {
-          text: `Your pull request was closed without merging${url} while this change was being added to it.`,
-          fails: false
-        };
-      }
-      if (branch.failure && (branch.state === "BLOCKED" || branchStoppedByFailure(branch))) {
-        const next = branch.failure.retryable ? "Fabric will try again on its own; see" : "See";
-        const what = branch.pullRequest ? `Your change is on your branch, but Fabric can no longer update its pull request${url}` : "Your change is on your branch, but Fabric could not open its pull request";
-        return {
-          text: `${what}: ${blockedReason(branch.failure)}. ${next} the project's Coding Instructions tab.`,
-          fails: true
-        };
-      }
-      if (branch.state === "CLOSE_REQUESTED") {
-        return {
-          text: "Your pull request is being closed, and this change leaves with it; push again once it has closed.",
-          fails: true
-        };
-      }
-      if (branch.state === "CANCELED") {
-        return {
-          text: "Your branch was closed before its pull request opened; push again.",
-          fails: true
-        };
-      }
-      if (branch.pullRequest?.state === "OPEN") {
-        return {
-          text: openedHere ? `Opened pull request ${branch.pullRequest.url}` : `Added to your pull request ${branch.pullRequest.url}`,
-          fails: false
-        };
-      }
-      return {
-        text: "Your change is on your branch and its pull request is being opened; see the project's Coding Instructions tab.",
-        fails: false
-      };
-    }
-    case "MERGED":
-      return {
-        text: `Its pull request was already merged${url}. Run \`${fabricCommand("instructions sync")}\` once the project has synced it.`,
-        fails: false
-      };
-    case "CLOSED":
-      return {
-        text: `Its pull request was closed without merging${url}.`,
-        fails: false
-      };
-    case "CANCELED":
-      if (pullRequest.failure?.code === "ALREADY_ON_BRANCH") {
-        return {
-          text: branch?.pullRequest ? `Already on your branch; nothing to add. Your pull request: ${branch.pullRequest.url}` : "Already on your branch; nothing to add.",
-          fails: false
-        };
-      }
-      return {
-        text: pullRequest.failure?.code === "VALIDATION_REJECTED" ? "The suggestion did not pass Fabric's checks, so no pull request was opened; see the project's Coding Instructions tab." : branch ? "The suggestion was withdrawn before it was added to your pull request." : "The suggestion was withdrawn before a pull request was opened.",
-        fails: true
-      };
-    case "CLOSE_REQUESTED":
-      return {
-        text: "An earlier attempt at this change was withdrawn and its pull request is being closed; push again once it has closed.",
-        fails: true
-      };
-    case "BLOCKED": {
-      const failure = pullRequest.failure ?? branch?.failure ?? null;
-      const reason = failure ? blockedReason(failure) : "it stopped with an unknown failure";
-      const next = failure?.retryable ? "Fabric will try again on its own; see" : "See";
-      const what = branch ? "Fabric could not add this change to your pull request" : "Fabric could not open the pull request";
-      return {
-        text: `${what}: ${reason}. ${next} the project's Coding Instructions tab.`,
-        fails: true
-      };
-    }
-    default:
-      return {
-        text: "The pull request is being opened; see the project's Coding Instructions tab.",
-        fails: false
-      };
-  }
-}
 function asPushFailure(error) {
   const code = error.code;
   switch (code) {
@@ -16583,6 +17629,8 @@ function reportPush(outcome) {
   );
 }
 function proposalReference(proposal) {
+  if (proposal.version === null)
+    return proposal.pullRequestUrl ? `pull request ${proposal.pullRequestUrl}` : "a repository suggestion";
   if (proposal.pullRequestUrl) {
     return `version ${proposal.version}, pull request ${proposal.pullRequestUrl}`;
   }
@@ -16594,6 +17642,7 @@ function proposalReference(proposal) {
 function proposalReferences(alreadyProposed) {
   const byVersion = /* @__PURE__ */ new Map();
   for (const entry of alreadyProposed) {
+    if (entry.proposal.version === null) continue;
     byVersion.set(
       entry.proposal.version,
       proposalReference({
@@ -16628,15 +17677,16 @@ async function isEmptyFolder(folder) {
     return error.code === "ENOENT";
   }
 }
-async function cloneProjectRepository(opts, destination, repository) {
+async function cloneProjectRepository(opts, destination, repository, transport) {
   if (repository === null) {
     throw outcomeFailure("no-clone-url", { repo: "its repository" });
   }
   const repo = repositoryName(repository);
-  const url = cloneUrlFor(repository);
-  if (url === null) {
+  const providerUrl = cloneUrlFor(repository);
+  if (providerUrl === null) {
     throw outcomeFailure("no-clone-url", { repo });
   }
+  const url = transport?.url ?? providerUrl;
   const ref = sanitizeDisplayText(repository.ref, 255);
   const wanted = opts.clone !== void 0 || canPrompt() && await confirm(`Clone ${repo} (${ref}) into this folder?`);
   if (!wanted) {
@@ -16648,14 +17698,15 @@ async function cloneProjectRepository(opts, destination, repository) {
     root,
     url,
     repository.ref,
-    Date.now() + CLONE_TIMEOUT_MS
+    Date.now() + CLONE_TIMEOUT_MS,
+    transport === null ? {} : { httpAuthorization: transport }
   );
   if (result.kind !== "cloned") {
     throw outcomeFailure("clone-failed", {
       repo,
       ref: repository.ref,
       host: repository.host,
-      url: shellQuote(url),
+      url: shellQuote(providerUrl),
       reason: result.kind === "failed" && result.reason !== "not-empty" ? result.reason : "other",
       login: providerLoginCommand(
         repository.provider,
@@ -16663,6 +17714,20 @@ async function cloneProjectRepository(opts, destination, repository) {
       )
     });
   }
+  if (transport !== null) {
+    const restored = await setRemoteUrl(
+      root,
+      "origin",
+      providerUrl,
+      Date.now() + CLONE_TIMEOUT_MS
+    );
+    if (restored.kind !== "ok") {
+      throw new CliFailure(
+        "Fabric cloned the repository but could not restore its provider remote. Remove this new checkout and run init again.",
+        7
+      );
+    }
+  }
   return classifyCheckout({
     destination: root,
     repository,
@@ -16697,6 +17762,8 @@ async function runInit(opts, format) {
     freshCloneDestination
   );
   const published = await fetchPublished(client, opts, void 0, guard);
+  const direct = directRepositoryRead(published);
+  let repositoryTransportApproved = false;
   const repository = published.repository ?? null;
   let checkout = guard.checkout;
   if (cloneFolder !== void 0 && checkout === null) {
@@ -16719,10 +17786,17 @@ async function runInit(opts, format) {
       throw planned.failure;
     }
     if (planned.kind === "empty-folder") {
+      let transport = null;
+      if (direct?.gitGateway?.version === "v1") {
+        await ensureRepositoryTransportScope(opts, client);
+        repositoryTransportApproved = true;
+        transport = await directGitTransport(opts, direct);
+      }
       checkout = await cloneProjectRepository(
         opts,
         destination,
-        repository
+        repository,
+        transport
       );
       cloned = true;
       if (cloneFolder !== void 0 && checkout.class === "unmapped") {
@@ -16819,6 +17893,10 @@ async function runInit(opts, format) {
       );
     }
   }
+  if (direct?.gitGateway?.version === "v1" && matching !== null && !repositoryTransportApproved) {
+    await ensureRepositoryTransportScope(opts, client);
+    repositoryTransportApproved = true;
+  }
   let outcome = null;
   if (checkout === null && published.published) {
     const synced = await syncOnce({ ...opts, hook: false, guard });
@@ -16943,7 +18021,22 @@ async function runInit(opts, format) {
       line("Removed the Stop hook for lesson capture.");
     }
   }
-  if (matching !== null && repository !== null) {
+  if (matching !== null && repository !== null && direct !== null) {
+    const report = await reportForClassification({
+      classification: matching,
+      repository,
+      snapshot: void 0,
+      deadline: gitDeadline()
+    });
+    line(
+      (await directRepositoryCheckoutStatus({
+        repository,
+        direct,
+        checkout: matching,
+        report
+      })).line
+    );
+  } else if (matching !== null && repository !== null) {
     if (published.snapshot?.source?.kind !== "REPOSITORY") {
       line(nothingPublishedLine(repository));
     }
@@ -17042,9 +18135,9 @@ async function runLessonPromptCommand(opts) {
 }
 
 // src/commands/mcp/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 function buildMcpCommand() {
-  const mcp = new Command13("mcp").description(
+  const mcp = new Command14("mcp").description(
     "Manage MCP servers and configurations"
   );
   mcp.command("servers").description("List accessible MCP servers (system + custom)").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
@@ -17082,7 +18175,7 @@ function buildMcpCommand() {
       });
     }
   );
-  const configs = new Command13("configs").description(
+  const configs = new Command14("configs").description(
     "Manage MCP configurations"
   );
   configs.command("list", { isDefault: true }).description("List your MCP configurations").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
@@ -17186,9 +18279,9 @@ function buildMcpCommand() {
 }
 
 // src/commands/orgs/index.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 function buildOrgsCommand() {
-  const orgs = new Command14("orgs").description("Manage organizations");
+  const orgs = new Command15("orgs").description("Manage organizations");
   orgs.command("list").description("List organizations you belong to").option(
     "--format <format>",
     "Output format: table|json|yaml|csv",
@@ -17244,9 +18337,9 @@ function buildOrgsCommand() {
 }
 
 // src/commands/projects/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 function buildProjectsCommand() {
-  const projects = new Command15("projects").description("Manage projects");
+  const projects = new Command16("projects").description("Manage projects");
   projects.command("list").description("List projects").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
     "--status <status>",
     "Filter by status: ACTIVE|DRAFT|COMPLETED|ARCHIVED"
@@ -17378,9 +18471,9 @@ function buildProjectsCommand() {
 }
 
 // src/commands/prompts/index.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 function buildPromptsCommand() {
-  const prompts = new Command16("prompts").description(
+  const prompts = new Command17("prompts").description(
     "Manage prompt templates"
   );
   prompts.command("list").description("List prompt templates").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--category <cat>", "Filter by category").option("--limit <n>", "Max results", "50").option(
@@ -17532,12 +18625,12 @@ ${content}
 }
 
 // src/commands/reports/index.ts
-import { Command as Command17 } from "commander";
+import { Command as Command18 } from "commander";
 function buildReportsCommand() {
-  const reports = new Command17("reports").description(
+  const reports = new Command18("reports").description(
     "Manage report templates and executions"
   );
-  const templates = new Command17("templates").description(
+  const templates = new Command18("templates").description(
     "Manage report templates"
   );
   templates.command("list", { isDefault: true }).description("List report templates").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--category <cat>", "Filter by category").option("--limit <n>", "Max results (default 20)", "20").option(
@@ -17610,7 +18703,7 @@ function buildReportsCommand() {
     }
   );
   reports.addCommand(templates);
-  const executions = new Command17("executions").description(
+  const executions = new Command18("executions").description(
     "View report executions"
   );
   executions.command("list", { isDefault: true }).description("List report executions").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--limit <n>", "Max results (default 20)", "20").option(
@@ -17654,9 +18747,9 @@ function buildReportsCommand() {
 }
 
 // src/commands/skills/index.ts
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 function buildSkillsCommand() {
-  const skills = new Command18("skills").description(
+  const skills = new Command19("skills").description(
     "Browse skill definitions"
   );
   skills.command("list").description("List skills").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--category <cat>", "Filter by category").option("--limit <n>", "Max results", "50").option(
@@ -17722,9 +18815,9 @@ function buildSkillsCommand() {
 }
 
 // src/commands/workflows/index.ts
-import { Command as Command19 } from "commander";
+import { Command as Command20 } from "commander";
 function buildWorkflowsCommand() {
-  const workflows = new Command19("workflows").description("Manage workflows");
+  const workflows = new Command20("workflows").description("Manage workflows");
   workflows.command("list").description("List workflows").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--status <status>", "Filter: DRAFT|ACTIVE|PAUSED|ARCHIVED").option("--search <query>", "Search by name").option("--limit <n>", "Max results", "20").option(
     "--format <format>",
     "Output format: table|json|yaml|csv",
@@ -17851,9 +18944,9 @@ function buildWorkflowsCommand() {
 }
 
 // src/commands/workspaces/index.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 function buildWorkspacesCommand() {
-  const workspaces = new Command20("workspaces").description(
+  const workspaces = new Command21("workspaces").description(
     "Manage workspaces"
   );
   workspaces.command("list").description("List workspaces").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--status <status>", "Filter: ACTIVE|ARCHIVED").option("--limit <n>", "Max results (default 20)", "20").option(
@@ -17928,13 +19021,13 @@ function buildWorkspacesCommand() {
 }
 
 // src/bin/fabric.ts
-var program = new Command21();
+var program = new Command22();
 program.name("fabric").description("Fabric AI platform CLI").version(package_default.version).option(
   "--format <format>",
   "Output format: table|json|yaml|csv",
   process.env.FABRIC_FORMAT ?? "table"
 );
-var auth = new Command21("auth").description(
+var auth = new Command22("auth").description(
   "Authenticate and manage API keys"
 );
 auth.addCommand(buildLoginCommand());
@@ -17942,6 +19035,7 @@ auth.addCommand(buildLogoutCommand());
 auth.addCommand(buildWhoamiCommand());
 auth.addCommand(buildKeysCommand());
 program.addCommand(auth);
+program.addCommand(buildConnectCommand());
 program.addCommand(buildCtxCommand());
 program.addCommand(buildOrgsCommand());
 program.addCommand(buildProjectsCommand());
@@ -17958,7 +19052,7 @@ program.addCommand(buildWorkspacesCommand());
 program.addCommand(buildChatsCommand());
 program.addCommand(buildReportsCommand());
 program.addCommand(buildCompletionCommand());
-var config = new Command21("config").description("Show CLI configuration");
+var config = new Command22("config").description("Show CLI configuration");
 config.command("path").description("Print the path to the config file").action(() => {
   process.stdout.write(`${getConfigPath()}
 `);