@fml-inc/fml 0.8.2 → 0.8.3

package/dist/pi/extension.js

@@ -1,8 +1,8 @@
 // src/pi/extension.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import fs2 from "node:fs";
-import os from "node:os";
-import path2 from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import fs4 from "node:fs";
+import os2 from "node:os";
+import path7 from "node:path";
 
 // ../../packages/agent-targets/src/install/pi/index.ts
 import fs from "node:fs";
@@ -149,125 +149,2741 @@ var PI_EXTENSION_INSTALLER = Object.freeze({
   }
 });
 
-// src/pi/extension.ts
-var DEFAULT_REQUEST_TIMEOUT_MS = 500;
-var DEFAULT_SHUTDOWN_FLUSH_TIMEOUT_MS = 5e3;
-var pendingPosts = /* @__PURE__ */ new Set();
-function positiveInteger(value, fallback) {
-  if (!value) return fallback;
-  const parsed = Number.parseInt(value, 10);
-  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+// src/hooks/context.ts
+import { createHash as createHash3 } from "node:crypto";
+import path6 from "node:path";
+
+// ../../packages/agent-targets/src/hooks/normalize.ts
+import { createHash } from "node:crypto";
+
+// ../../packages/agent-targets/src/hooks/types.ts
+var HOOK_TARGETS = Object.freeze([
+  "claude",
+  "codex",
+  "gemini",
+  "grok",
+  "pi"
+]);
+
+// ../../packages/agent-targets/src/catalog/hook-events.json
+var hook_events_default = {
+  claude: [
+    "SessionStart",
+    "Setup",
+    "InstructionsLoaded",
+    "UserPromptSubmit",
+    "UserPromptExpansion",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "PostToolBatch",
+    "PermissionDenied",
+    "Notification",
+    "SubagentStart",
+    "SubagentStop",
+    "TaskCreated",
+    "TaskCompleted",
+    "Stop",
+    "StopFailure",
+    "TeammateIdle",
+    "ConfigChange",
+    "CwdChanged",
+    "PreCompact",
+    "PostCompact",
+    "SessionEnd",
+    "Elicitation",
+    "ElicitationResult"
+  ],
+  codex: [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "Stop"
+  ],
+  gemini: [
+    "SessionStart",
+    "BeforeAgent",
+    "BeforeTool",
+    "AfterTool",
+    "AfterAgent"
+  ],
+  grok: [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "PermissionDenied",
+    "Stop",
+    "StopFailure",
+    "Notification",
+    "SubagentStart",
+    "SubagentStop",
+    "PreCompact",
+    "PostCompact",
+    "SessionEnd"
+  ],
+  pi: [
+    "SessionStart",
+    "UserPromptSubmit",
+    "TurnStart",
+    "PreToolUse",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "Stop",
+    "Notification",
+    "ConfigChange",
+    "PreCompact",
+    "PostCompact",
+    "SessionEnd"
+  ]
+};
+
+// ../../packages/agent-targets/src/catalog/hook-events.ts
+var CLAUDE_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.claude
+]);
+var CODEX_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.codex
+]);
+var GEMINI_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.gemini
+]);
+var GROK_HOOK_EVENTS = Object.freeze([
+  ...hook_events_default.grok
+]);
+var PI_HOOK_EVENTS = Object.freeze([...hook_events_default.pi]);
+
+// ../../packages/agent-targets/src/hooks/read-command.ts
+import path2 from "node:path";
+var SHELL_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "bash",
+  "exec_command",
+  "shell"
+]);
+var COMMAND_SEPARATORS = /* @__PURE__ */ new Set([
+  ";",
+  "&",
+  "&&",
+  "|",
+  "||",
+  "<",
+  "<<",
+  ">",
+  ">>",
+  ">&1",
+  ">&2",
+  "1>",
+  "1>>",
+  "1>&1",
+  "1>&2",
+  "2>",
+  "2>>",
+  "2>&1",
+  "2>&2"
+]);
+function tokenizeShellLikeCommand(command) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let escaping = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (escaping) {
+      current += character;
+      escaping = false;
+      continue;
+    }
+    if (character === "\\") {
+      escaping = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      else current += character;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (current === "" && (character === "1" || character === "2") && command[index + 1] === ">") {
+      if (command[index + 2] === ">") {
+        tokens.push(`${character}>>`);
+        index += 2;
+      } else if (command[index + 2] === "&" && (command[index + 3] === "1" || command[index + 3] === "2")) {
+        tokens.push(`${character}>&${command[index + 3]}`);
+        index += 3;
+      } else {
+        tokens.push(`${character}>`);
+        index += 1;
+      }
+      continue;
+    }
+    if (/[;&|<>]/.test(character)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+      const next = command[index + 1];
+      if (character === ">" && next === "&" && (command[index + 2] === "1" || command[index + 2] === "2")) {
+        tokens.push(`>&${command[index + 2]}`);
+        index += 2;
+        continue;
+      }
+      if (character === "&" && next === "&" || character === "|" && next === "|" || character === "<" && next === "<" || character === ">" && next === ">") {
+        tokens.push(`${character}${next}`);
+        index += 1;
+        continue;
+      }
+      tokens.push(character);
+      continue;
+    }
+    if (/\s/.test(character)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += character;
+  }
+  if (quote || escaping) return [];
+  if (current) tokens.push(current);
+  return tokens;
 }
-function absoluteEnvPath(value) {
-  if (!value?.trim()) return void 0;
-  const trimmed = value.trim();
-  if (trimmed === "~") return os.homedir();
-  if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) {
-    return path2.join(os.homedir(), trimmed.slice(2));
+function splitCommandSegments(tokens) {
+  const segments = [];
+  let current = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (COMMAND_SEPARATORS.has(token)) {
+      if (current.length > 0) {
+        segments.push(current);
+        current = [];
+      }
+      if (token === "<" || token === "<<") index += 1;
+      continue;
+    }
+    current.push(token);
   }
-  return path2.isAbsolute(trimmed) ? path2.normalize(trimmed) : void 0;
+  if (current.length > 0) segments.push(current);
+  return segments;
 }
-function observerDirectory() {
-  const fmlHome = absoluteEnvPath(process.env.FML_HOME);
-  return absoluteEnvPath(process.env.FML_OBSERVER_DIR) ?? absoluteEnvPath(process.env.PANOPTICON_HOME) ?? (fmlHome ? path2.join(fmlHome, "panopticon") : path2.join(os.homedir(), ".fml", "panopticon"));
+function stripSimpleOptions(args, flagsWithValues = /* @__PURE__ */ new Set(), patternFlags = /* @__PURE__ */ new Set()) {
+  const remaining = [];
+  let consumedPatternFlag = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (argument === "--") {
+      remaining.push(...args.slice(index + 1));
+      break;
+    }
+    if (argument.startsWith("-") && argument.length > 1) {
+      if (flagsWithValues.has(argument)) {
+        if (patternFlags.has(argument)) consumedPatternFlag = true;
+        if (!argument.includes("=")) index += 1;
+      }
+      continue;
+    }
+    remaining.push(argument);
+  }
+  return { args: remaining, consumedPatternFlag };
 }
-function readObserverEndpoint(filePath) {
+function readCommandFileArgs(args, flagsWithValues, patternFlags = flagsWithValues) {
+  const stripped = stripSimpleOptions(args, flagsWithValues, patternFlags);
+  return stripped.consumedPatternFlag ? stripped.args : stripped.args.slice(1);
+}
+function isPlausibleReadPath(argument) {
+  if (!argument || argument === "-" || argument.startsWith("-")) return false;
+  if (COMMAND_SEPARATORS.has(argument)) return false;
+  if (/[\0*?[{}`$]/.test(argument)) return false;
+  if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(argument)) return false;
+  return path2.posix.isAbsolute(argument) || path2.win32.isAbsolute(argument) || argument.startsWith("~/") || argument.startsWith("./") || argument.startsWith("../") || argument.includes("/") || /\.[A-Za-z0-9][A-Za-z0-9_-]*$/.test(argument) || /^[A-Z][A-Za-z0-9_.-]*$/.test(argument);
+}
+function filePathFromSegment(tokens) {
+  const commandTokens = [...tokens];
+  while (commandTokens[0]?.includes("=") && /^[A-Za-z_][A-Za-z0-9_]*=/.test(commandTokens[0])) {
+    commandTokens.shift();
+  }
+  const commandName = commandTokens.shift()?.split("/").pop();
+  if (!commandName) return null;
+  let args;
+  switch (commandName) {
+    case "bat":
+    case "batcat":
+    case "cat":
+    case "file":
+    case "less":
+    case "more":
+    case "nl":
+    case "stat":
+    case "wc":
+      args = stripSimpleOptions(commandTokens).args;
+      break;
+    case "head":
+    case "tail":
+      args = stripSimpleOptions(commandTokens, /* @__PURE__ */ new Set(["-n", "-c"])).args;
+      break;
+    case "sed":
+      if (commandTokens.some(
+        (argument) => argument.startsWith("-i") || argument === "--in-place" || argument.startsWith("--in-place=")
+      )) {
+        return null;
+      }
+      args = readCommandFileArgs(commandTokens, /* @__PURE__ */ new Set(["-e", "-f"]));
+      break;
+    case "awk":
+      args = readCommandFileArgs(
+        commandTokens,
+        /* @__PURE__ */ new Set(["-f", "-v"]),
+        /* @__PURE__ */ new Set(["-f"])
+      );
+      break;
+    case "grep":
+    case "rg":
+      args = readCommandFileArgs(
+        commandTokens,
+        /* @__PURE__ */ new Set(["-A", "-B", "-C", "-e", "-f", "-g", "-m", "-t"]),
+        /* @__PURE__ */ new Set(["-e", "-f"])
+      );
+      break;
+    default:
+      return null;
+  }
+  return args.find(isPlausibleReadPath) ?? null;
+}
+function extractReadFilePathFromCommand(command) {
+  const tokens = tokenizeShellLikeCommand(command);
+  if (tokens.length === 0) return null;
+  for (let index = 0; index < tokens.length - 1; index += 1) {
+    if (tokens[index] === "<" && isPlausibleReadPath(tokens[index + 1])) {
+      return tokens[index + 1];
+    }
+  }
+  for (const segment of splitCommandSegments(tokens)) {
+    const filePath = filePathFromSegment(segment);
+    if (filePath) return filePath;
+  }
+  return null;
+}
+
+// ../../packages/agent-targets/src/hooks/normalize.ts
+var MAX_EXTRACTED_TEXT_BYTES = 64 * 1024;
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function firstString(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+function extractedText(value) {
+  if (typeof value === "string") return value;
+  if (value === void 0 || value === null) return void 0;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function firstText(record, keys) {
+  for (const key of keys) {
+    const value = extractedText(record[key]);
+    if (value !== void 0 && value.length > 0) return value;
+  }
+  return void 0;
+}
+function utf8Prefix(value, maxBytes) {
+  let low = 0;
+  let high = value.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(value.slice(0, middle), "utf8") <= maxBytes) {
+      low = middle;
+    } else {
+      high = middle - 1;
+    }
+  }
+  let end = low;
+  if (end > 0 && end < value.length && value.charCodeAt(end - 1) >= 55296 && value.charCodeAt(end - 1) <= 56319 && value.charCodeAt(end) >= 56320 && value.charCodeAt(end) <= 57343) {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+function boundedExtractedText(value, field) {
+  if (value === void 0) return void 0;
+  const originalBytes = Buffer.byteLength(value, "utf8");
+  if (originalBytes <= MAX_EXTRACTED_TEXT_BYTES) return value;
+  const digest = createHash("sha256").update(value).digest("hex");
+  const marker = `
+[fml:${field}:truncated originalBytes=${originalBytes} sha256=${digest}]`;
+  return `${utf8Prefix(
+    value,
+    MAX_EXTRACTED_TEXT_BYTES - Buffer.byteLength(marker, "utf8")
+  )}${marker}`;
+}
+function nestedRecord(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (isRecord(value)) return value;
+  }
+  return void 0;
+}
+function timestampMs(payload, fallback) {
+  for (const key of ["timestamp_ms", "timestampMs", "timestamp"]) {
+    const value = payload[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      const milliseconds = Math.round(
+        value < 1e10 ? value * 1e3 : value
+      );
+      if (Number.isSafeInteger(milliseconds) && milliseconds > 0) {
+        return milliseconds;
+      }
+    }
+    if (typeof value === "string") {
+      const parsed = Date.parse(value);
+      if (Number.isSafeInteger(parsed) && parsed >= 0) return parsed;
+    }
+  }
+  return fallback;
+}
+function geminiEventType(eventType) {
+  switch (eventType) {
+    case "BeforeAgent":
+    case "BeforeModel":
+      return "UserPromptSubmit";
+    case "BeforeTool":
+      return "PreToolUse";
+    case "AfterTool":
+      return "PostToolUse";
+    case "AfterAgent":
+      return "Stop";
+    default:
+      return eventType;
+  }
+}
+var GROK_EVENT_TYPES = Object.freeze({
+  session_start: "SessionStart",
+  user_prompt_submit: "UserPromptSubmit",
+  pre_tool_use: "PreToolUse",
+  post_tool_use: "PostToolUse",
+  post_tool_use_failure: "PostToolUseFailure",
+  permission_denied: "PermissionDenied",
+  stop: "Stop",
+  stop_failure: "StopFailure",
+  notification: "Notification",
+  subagent_start: "SubagentStart",
+  subagent_stop: "SubagentStop",
+  pre_compact: "PreCompact",
+  post_compact: "PostCompact",
+  session_end: "SessionEnd"
+});
+function grokEventType(eventType) {
+  return Object.hasOwn(GROK_EVENT_TYPES, eventType) ? GROK_EVENT_TYPES[eventType] ?? eventType : eventType;
+}
+function geminiUserPrompt(payload) {
+  const request = payload.llm_request;
+  if (!isRecord(request) || !Array.isArray(request.messages)) return void 0;
+  const userMessage = [...request.messages].reverse().find(
+    (message) => isRecord(message) && message.role === "user"
+  );
+  if (!userMessage) return void 0;
+  if (typeof userMessage.content === "string") {
+    return userMessage.content || void 0;
+  }
+  if (!Array.isArray(userMessage.content)) return void 0;
+  const text = userMessage.content.filter(
+    (part) => isRecord(part) && part.type === "text" && typeof part.text === "string"
+  ).map((part) => part.text).join("\n");
+  return text || void 0;
+}
+function normalizedEvent(target, payload, context) {
+  const sessionId = firstString(payload, [
+    "session_id",
+    "sessionId",
+    "conversation_id",
+    "conversationId"
+  ]);
+  const rawEventType = firstString(payload, [
+    "hook_event_name",
+    "hookEventName",
+    "event_name",
+    "eventName",
+    "event"
+  ]);
+  if (!sessionId || !rawEventType) return null;
+  const eventType = target === "gemini" ? geminiEventType(rawEventType) : target === "grok" ? grokEventType(rawEventType) : rawEventType;
+  const toolInput = nestedRecord(payload, ["tool_input", "toolInput"]);
+  const cwd = firstString(payload, [
+    "cwd",
+    "working_directory",
+    "workingDirectory",
+    "workspaceRoot"
+  ]) ?? context.cwd;
+  const command = boundedExtractedText(
+    firstText(payload, ["command"]) ?? (toolInput ? firstText(toolInput, ["command", "cmd"]) : void 0),
+    "command"
+  );
+  const toolName = firstString(payload, ["tool_name", "toolName", "name"]);
+  const filePath = firstString(payload, ["file_path", "filePath", "path"]) ?? (toolInput ? firstString(toolInput, ["file_path", "filePath", "path"]) : void 0) ?? (command && toolName && SHELL_TOOL_NAMES.has(toolName.toLowerCase()) ? extractReadFilePathFromCommand(command) ?? void 0 : void 0);
+  const userPrompt = boundedExtractedText(
+    firstText(payload, ["prompt", "user_prompt", "userPrompt"]) ?? (target === "gemini" ? geminiUserPrompt(payload) : void 0),
+    "user_prompt"
+  );
+  const plan = boundedExtractedText(firstText(payload, ["plan"]), "plan");
+  const allowedPrompts = boundedExtractedText(
+    firstText(payload, ["allowed_prompts", "allowedPrompts"]),
+    "allowed_prompts"
+  );
+  const toolResult = boundedExtractedText(
+    firstText(payload, [
+      "tool_result",
+      "toolResult",
+      "tool_response",
+      "toolResponse"
+    ]),
+    "tool_result"
+  );
+  const nativeEventId = firstString(payload, [
+    "hook_id",
+    "hookId",
+    "event_id",
+    "eventId",
+    "tool_use_id",
+    "toolUseId",
+    "tool_call_id",
+    "toolCallId",
+    "prompt_id",
+    "promptId"
+  ]) ?? (eventType === "UserPromptSubmit" || eventType === "Stop" ? firstString(payload, ["turn_id", "turnId"]) : void 0);
+  return {
+    sessionId,
+    eventType,
+    timestampMs: timestampMs(payload, context.nowMs),
+    ...nativeEventId ? { nativeEventId } : {},
+    ...cwd ? { cwd } : {},
+    ...toolName ? { toolName } : {},
+    ...userPrompt ? { userPrompt } : {},
+    ...filePath ? { filePath } : {},
+    ...command ? { command } : {},
+    ...plan ? { plan } : {},
+    ...allowedPrompts ? { allowedPrompts } : {},
+    ...toolResult ? { toolResult } : {}
+  };
+}
+function capability(targetId, nativeEvents) {
+  return Object.freeze({
+    targetId,
+    nativeEvents,
+    normalize: (payload, context) => normalizedEvent(targetId, payload, context)
+  });
+}
+var HOOK_NORMALIZATION_CAPABILITIES = Object.freeze([
+  capability("claude", CLAUDE_HOOK_EVENTS),
+  capability("codex", CODEX_HOOK_EVENTS),
+  capability("gemini", GEMINI_HOOK_EVENTS),
+  capability("grok", GROK_HOOK_EVENTS),
+  capability("pi", PI_HOOK_EVENTS)
+]);
+
+// src/auth/token-store.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import fs3 from "node:fs";
+import path5 from "node:path";
+
+// src/config.ts
+import fs2 from "node:fs";
+import path4 from "node:path";
+
+// src/dirs.ts
+import os from "node:os";
+import path3 from "node:path";
+function isPresent(value) {
+  return value !== void 0 && value.trim().length > 0;
+}
+function normalizeAbsolutePath(value, variableName, pathApi) {
+  if (!pathApi.isAbsolute(value)) {
+    throw new Error(`${variableName} must be an absolute path: ${value}`);
+  }
+  return pathApi.normalize(value);
+}
+function explicitDirectory(value, variableName, pathApi) {
+  if (!isPresent(value)) return void 0;
+  return normalizeAbsolutePath(value, variableName, pathApi);
+}
+function platformBaseDirectory(value, pathApi) {
+  if (!isPresent(value) || !pathApi.isAbsolute(value)) return void 0;
+  return pathApi.normalize(value);
+}
+function resolveFmlDirectories(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const pathApi = platform === "win32" ? path3.win32 : path3.posix;
+  const homeDir = normalizeAbsolutePath(
+    options.homeDir ?? os.homedir(),
+    "home directory",
+    pathApi
+  );
+  const explicitDataDir = explicitDirectory(
+    env.FML_DATA_DIR,
+    "FML_DATA_DIR",
+    pathApi
+  );
+  const explicitStateDir = explicitDirectory(
+    env.FML_STATE_DIR,
+    "FML_STATE_DIR",
+    pathApi
+  );
+  const explicitLogDir = explicitDirectory(
+    env.FML_LOG_DIR,
+    "FML_LOG_DIR",
+    pathApi
+  );
+  let defaultDataDir;
+  let defaultStateDir;
+  let nativeLogDir;
+  switch (platform) {
+    case "darwin": {
+      defaultDataDir = pathApi.join(
+        homeDir,
+        "Library",
+        "Application Support",
+        "fml"
+      );
+      defaultStateDir = defaultDataDir;
+      nativeLogDir = pathApi.join(homeDir, "Library", "Logs", "fml");
+      break;
+    }
+    case "win32": {
+      const roamingAppData = platformBaseDirectory(env.APPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Roaming");
+      const localAppData = platformBaseDirectory(env.LOCALAPPDATA, pathApi) ?? pathApi.join(homeDir, "AppData", "Local");
+      defaultDataDir = pathApi.join(roamingAppData, "fml");
+      defaultStateDir = pathApi.join(localAppData, "fml");
+      break;
+    }
+    default: {
+      const xdgDataHome = platformBaseDirectory(env.XDG_DATA_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "share");
+      const xdgStateHome = platformBaseDirectory(env.XDG_STATE_HOME, pathApi) ?? pathApi.join(homeDir, ".local", "state");
+      defaultDataDir = pathApi.join(xdgDataHome, "fml");
+      defaultStateDir = pathApi.join(xdgStateHome, "fml");
+      break;
+    }
+  }
+  const dataDir = explicitDataDir ?? defaultDataDir;
+  const stateDir = explicitStateDir ?? explicitDataDir ?? defaultStateDir;
+  const defaultLogDir = nativeLogDir ?? (platform === "win32" ? pathApi.join(defaultDataDir, "logs") : pathApi.join(defaultStateDir, "log"));
+  const explicitObserverDir = explicitDirectory(
+    env.FML_OBSERVER_DIR,
+    "FML_OBSERVER_DIR",
+    pathApi
+  );
+  const legacyPanopticonHome = explicitDirectory(
+    env.PANOPTICON_HOME,
+    "PANOPTICON_HOME",
+    pathApi
+  );
+  const fmlHome = explicitDirectory(env.FML_HOME, "FML_HOME", pathApi);
+  return {
+    dataDir,
+    stateDir,
+    logDir: explicitLogDir ?? defaultLogDir,
+    observerDir: explicitObserverDir ?? legacyPanopticonHome ?? (fmlHome ? pathApi.join(fmlHome, "panopticon") : pathApi.join(homeDir, ".fml", "panopticon"))
+  };
+}
+function observerPort() {
+  const configured = process.env.FML_OBSERVER_PORT ?? process.env.PANOPTICON_PORT;
+  if (configured) {
+    const parsed = Number.parseInt(configured, 10);
+    if (Number.isInteger(parsed) && parsed > 0 && parsed <= 65535) {
+      return parsed;
+    }
+  }
+  return 4318 + (process.getuid?.() ?? 0) % 100;
+}
+var DIRECTORIES = resolveFmlDirectories();
+var FML_DATA_DIR = DIRECTORIES.dataDir;
+var FML_STATE_DIR = DIRECTORIES.stateDir;
+var FML_LOG_DIR = DIRECTORIES.logDir;
+var FML_OBSERVER_DIR = DIRECTORIES.observerDir;
+var FML_OBSERVER_PORT = observerPort();
+var FML_OBSERVER_STATE_FILE = path3.join(
+  FML_OBSERVER_DIR,
+  "observer.pid.json"
+);
+var FML_OBSERVER_LOCK_FILE = path3.join(
+  FML_OBSERVER_DIR,
+  "observer.lock"
+);
+var FML_OBSERVER_AUTH_TOKEN_FILE = path3.join(
+  FML_OBSERVER_DIR,
+  "auth-token"
+);
+var FML_OBSERVER_ENDPOINT_FILE = path3.join(
+  FML_OBSERVER_DIR,
+  "endpoint.json"
+);
+var FML_OBSERVER_LOG_FILE = path3.join(FML_LOG_DIR, "observer.log");
+var FML_INSTALLATION_ID_FILE = path3.join(
+  FML_STATE_DIR,
+  "installation_id"
+);
+var FML_PANOPTICON_DB_FILE = path3.join(FML_STATE_DIR, "panopticon.db");
+var FML_PANOPTICON_DB_OBSERVER_STATE_FILE = `${FML_PANOPTICON_DB_FILE}.observer.pid.json`;
+var FML_PANOPTICON_DB_OBSERVER_LOCK_FILE = `${FML_PANOPTICON_DB_FILE}.observer.lock`;
+var FML_LEGACY_OBSERVER_DB_FILE = path3.join(
+  FML_OBSERVER_DIR,
+  "observer.db"
+);
+var FML_HOOK_INBOX_DIR = path3.join(FML_OBSERVER_DIR, "hook-inbox");
+var FML_HOOK_CONTEXT_STATE_DIR = path3.join(
+  FML_OBSERVER_DIR,
+  "hook-context-state"
+);
+var FML_HOOK_CAPTURE_DISABLED_FILE = path3.join(
+  FML_OBSERVER_DIR,
+  "hook-capture.disabled"
+);
+
+// src/config.ts
+var DEFAULT_PROD_URL = "https://trustworthy-chihuahua-382.convex.cloud";
+var DEFAULT_SYNC_URL = DEFAULT_PROD_URL.replace(
+  ".convex.cloud",
+  ".convex.site"
+);
+var DEFAULT_TARGET_NAME = "fml";
+var ENV_CONFIG_PATH = path4.join(FML_DATA_DIR, "env.json");
+var ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
+function isValidEnvName(envName) {
+  return ENV_NAME_RE.test(envName);
+}
+function normalizeConvexUrl(value) {
+  const url = new URL(value);
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") {
+    throw new Error(
+      "FML environment URL must be HTTPS (HTTP is allowed only for loopback) with no path, credentials, query, or fragment"
+    );
+  }
+  return value.replace(/\/$/, "").replace(".convex.site", ".convex.cloud");
+}
+function readEnvConfig() {
   try {
-    const parsed = JSON.parse(fs2.readFileSync(filePath, "utf8"));
+    const parsed = JSON.parse(
+      fs2.readFileSync(ENV_CONFIG_PATH, "utf8")
+    );
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return null;
+      throw new Error("invalid environment config");
     }
-    const record = parsed;
-    if (record.host !== "127.0.0.1" && record.host !== "::1" && record.host !== "localhost" || typeof record.port !== "number" || !Number.isInteger(record.port) || record.port <= 0 || record.port > 65535) {
-      return null;
+    const config = parsed;
+    if (typeof config.active !== "string" || !isValidEnvName(config.active)) {
+      throw new Error("invalid active environment");
     }
-    return { host: record.host, port: record.port };
+    const environments = {};
+    if (config.environments && typeof config.environments === "object" && !Array.isArray(config.environments)) {
+      for (const [name, environment] of Object.entries(
+        config.environments
+      )) {
+        if (!isValidEnvName(name) || !environment || typeof environment !== "object" || Array.isArray(environment)) {
+          continue;
+        }
+        const convexUrl = environment.convexUrl;
+        if (typeof convexUrl !== "string") continue;
+        try {
+          environments[name] = { convexUrl: normalizeConvexUrl(convexUrl) };
+        } catch {
+        }
+      }
+    }
+    return {
+      schemaVersion: 1,
+      active: config.active,
+      environments
+    };
   } catch {
-    return null;
+    return {
+      schemaVersion: 1,
+      active: DEFAULT_TARGET_NAME,
+      environments: {
+        [DEFAULT_TARGET_NAME]: { convexUrl: DEFAULT_PROD_URL }
+      }
+    };
   }
 }
-function readObserverAuthToken(filePath) {
+function resolveEnvConvexUrl(envName) {
+  const configured = readEnvConfig().environments?.[envName]?.convexUrl;
+  if (configured) return configured;
+  if (envName === DEFAULT_TARGET_NAME) return DEFAULT_PROD_URL;
+  return null;
+}
+function getActiveEnv() {
+  const name = readEnvConfig().active;
+  const override = process.env.FML_CONVEX_URL;
+  return {
+    name,
+    convexUrl: override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name)
+  };
+}
+function authStorePathFor(envName) {
+  return path4.join(FML_DATA_DIR, `auth.${envName}.json`);
+}
+var CONVEX_URL = (process.env.FML_CONVEX_URL ?? getActiveEnv().convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
+var WORKOS_API_URL = "https://api.workos.com";
+function getSiteUrlForConvexUrl(convexUrl) {
+  const explicit = process.env.CONVEX_SITE_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  return (convexUrl ?? DEFAULT_PROD_URL).replace(".convex.cloud", ".convex.site").replace(/\/$/, "");
+}
+
+// src/sentry.ts
+var sentry = null;
+var client = null;
+var Sentry = {
+  captureException: (err) => sentry?.captureException(err),
+  captureMessage: (msg) => sentry?.captureMessage(msg),
+  flush: async (timeoutMs) => {
+    try {
+      await client?.flush(timeoutMs);
+    } catch {
+    }
+  }
+};
+
+// src/auth/token-store.ts
+var TOKEN_REFRESH_WINDOW_MS = 6e4;
+var OAUTH_REFRESH_LOCK_POLL_MS = 50;
+var OAUTH_REFRESH_LOCK_STALE_MS = 45e3;
+var OAUTH_REFRESH_RECOVERY_STALE_MS = 45e3;
+var OAUTH_REFRESH_LOCK_WAIT_MS = 6e4;
+var OAUTH_REFRESH_REQUEST_TIMEOUT_MS = 3e4;
+var PROCESS_IDENTITY_STALE_MS = 45e3;
+var PROCESS_IDENTITY_RECHECK_MS = 5e3;
+var PROCESS_INSTANCE_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-instance");
+var PROCESS_IDENTITY_KEY = /* @__PURE__ */ Symbol.for("@fml-inc/fml:auth-process-identity");
+var processGlobals = globalThis;
+var existingProcessInstanceId = processGlobals[PROCESS_INSTANCE_KEY];
+var CURRENT_PROCESS_INSTANCE_ID = typeof existingProcessInstanceId === "string" ? existingProcessInstanceId : randomUUID2();
+processGlobals[PROCESS_INSTANCE_KEY] = CURRENT_PROCESS_INSTANCE_ID;
+function getCurrentProcessIdentity() {
+  let cache = processGlobals[PROCESS_IDENTITY_KEY];
+  if (!cache) {
+    cache = { resolved: false };
+    processGlobals[PROCESS_IDENTITY_KEY] = cache;
+  }
+  if (!cache.resolved) {
+    cache.value = getProcessIdentity(process.pid) ?? void 0;
+    cache.resolved = true;
+  }
+  return cache.value;
+}
+function storePathFor(envName) {
+  return authStorePathFor(envName ?? getActiveEnv().name);
+}
+function resolveEnvName(envName) {
+  return envName ?? getActiveEnv().name;
+}
+function ensureDir(envName) {
+  const dir = path5.dirname(storePathFor(envName));
+  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
   try {
-    return fs2.readFileSync(filePath, "utf8").trim() || null;
+    fs3.chmodSync(dir, 448);
   } catch {
-    return null;
   }
 }
-async function deliver(event) {
-  const directory = observerDirectory();
-  const endpoint = readObserverEndpoint(path2.join(directory, "endpoint.json"));
-  const authToken = readObserverAuthToken(path2.join(directory, "auth-token"));
-  if (!endpoint || !authToken) return;
-  const host = endpoint.host === "::1" ? "[::1]" : endpoint.host;
+function writeSecretFile(filePath, data) {
+  const temporaryFile = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
+  let descriptor = null;
   try {
-    const response = await fetch(`http://${host}:${endpoint.port}/hooks`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${authToken}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        target: "pi",
-        payload: event,
-        ...event.cwd ? { cwd: event.cwd } : {}
-      }),
-      signal: AbortSignal.timeout(
-        positiveInteger(
-          process.env.FML_PI_REQUEST_TIMEOUT_MS,
-          DEFAULT_REQUEST_TIMEOUT_MS
-        )
-      )
-    });
-    await response.arrayBuffer();
+    descriptor = fs3.openSync(temporaryFile, "wx", 384);
+    fs3.writeFileSync(descriptor, data, { encoding: "utf8" });
+    fs3.fsyncSync(descriptor);
+    fs3.closeSync(descriptor);
+    descriptor = null;
+    fs3.renameSync(temporaryFile, filePath);
+    try {
+      fs3.chmodSync(filePath, 384);
+    } catch {
+    }
+  } finally {
+    if (descriptor !== null) {
+      try {
+        fs3.closeSync(descriptor);
+      } catch {
+      }
+    }
+    try {
+      fs3.unlinkSync(temporaryFile);
+    } catch {
+    }
+  }
+}
+function readTokens(envName) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(storePathFor(envName), "utf-8");
+  } catch {
+    return null;
+  }
+  try {
+    return parseStoredAuthShape(JSON.parse(raw));
   } catch {
+    return null;
   }
 }
-function post(event) {
-  const request = deliver(event);
-  pendingPosts.add(request);
-  void request.finally(() => pendingPosts.delete(request));
+var CorruptStoredCredentialsError = class extends Error {
+};
+function parseStoredAuthShape(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const auth = parsed;
+  const user = auth.user;
+  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
+    return null;
+  }
+  return auth;
 }
-async function flushPendingPosts(timeoutMs = positiveInteger(
-  process.env.FML_PI_SHUTDOWN_FLUSH_TIMEOUT_MS,
-  DEFAULT_SHUTDOWN_FLUSH_TIMEOUT_MS
-)) {
-  if (pendingPosts.size === 0) return;
-  await Promise.race([
-    Promise.allSettled([...pendingPosts]),
-    new Promise((resolve) => setTimeout(resolve, timeoutMs))
-  ]);
+function readTokensForReconciliation(envName) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(storePathFor(envName), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new CorruptStoredCredentialsError(
+      "Stored credentials are not valid JSON",
+      { cause: error }
+    );
+  }
+  const auth = parseStoredAuthShape(parsed);
+  if (!auth) {
+    throw new CorruptStoredCredentialsError(
+      "Stored credentials have an invalid shape"
+    );
+  }
+  return auth;
 }
-function modelLabel(model) {
-  if (!model || typeof model !== "object") return void 0;
-  const record = model;
-  const id = record.id ?? record.name ?? record.model;
-  const provider = record.provider ?? record.providerId;
-  return [provider, id].filter((value) => typeof value === "string" && value.length > 0).join(":") || void 0;
+function writeTokensUnlocked(auth, envName) {
+  ensureDir(envName);
+  writeSecretFile(storePathFor(envName), JSON.stringify(auth, null, 2));
 }
-function fmlPiExtension(pi) {
-  let sessionId = randomUUID2();
-  let cwd;
-  function emit(event) {
-    post({
-      ...event,
-      session_id: sessionId,
-      source: "pi",
-      cwd
-    });
+function credentialHash(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function describeError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function getSyncDestinationAuthBinding(envName) {
+  const resolvedEnvName = resolveEnvName(envName);
+  const envToken = process.env.FML_TOKEN;
+  if (envToken?.startsWith("fml_srt_")) {
+    return {
+      destinationIdentity: `service-refresh:${credentialHash(envToken)}`
+    };
   }
-  pi.on("session_start", async (_event, context) => {
-    sessionId = context.sessionManager.getSessionId();
-    cwd = context.cwd;
-    emit({ hook_event_name: "SessionStart" });
+  if (envToken?.startsWith("fml_st_")) {
+    return {
+      destinationIdentity: `service-access:${credentialHash(envToken)}`
+    };
+  }
+  const stored = readTokens(resolvedEnvName);
+  if (!stored) return null;
+  if (stored.tokenType === "service") {
+    return {
+      destinationIdentity: `service-refresh:${credentialHash(stored.refreshToken)}`
+    };
+  }
+  const destinationIdentity = `oauth-user:${stored.user.id}`;
+  if (stored.orgId && stored.orgSlug) {
+    return {
+      destinationIdentity,
+      organizationId: stored.orgId,
+      organizationSlug: stored.orgSlug
+    };
+  }
+  return { destinationIdentity, organizationSelectionRequired: true };
+}
+function getSyncDestinationIdentity(envName) {
+  return getSyncDestinationAuthBinding(envName)?.destinationIdentity ?? null;
+}
+var serviceTokenCaches = /* @__PURE__ */ new Map();
+var serviceRefreshPromises = /* @__PURE__ */ new Map();
+var oauthRefreshPromises = /* @__PURE__ */ new Map();
+var cacheKey = (envName) => envName;
+function waitForTokenRefresh(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.resolve(null);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      resolve(null);
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    void promise.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (error) => {
+        cleanup();
+        reject(error);
+      }
+    );
   });
-  pi.on("input", async (event) => {
-    emit({ hook_event_name: "UserPromptSubmit", prompt: event.text });
+}
+function getOrStartTokenRefresh(flights, key, forceRefresh, refresh, signal) {
+  const existing = flights.get(key);
+  if (existing && (!forceRefresh || existing.forceRefresh)) {
+    return waitForTokenRefresh(existing.promise, signal);
+  }
+  const operation = existing ? existing.promise.then(refresh, refresh) : refresh();
+  let flight;
+  const promise = operation.finally(() => {
+    if (flights.get(key) === flight) flights.delete(key);
   });
-  pi.on("turn_start", async (event) => {
-    emit({
-      hook_event_name: "TurnStart",
-      turn_index: event.turnIndex,
-      pi_timestamp: event.timestamp
+  flight = { forceRefresh, promise };
+  flights.set(key, flight);
+  return waitForTokenRefresh(promise, signal);
+}
+function refreshLockPath(envName) {
+  return `${storePathFor(envName)}.refresh.lock`;
+}
+function pendingOAuthRefreshPrefix(envName) {
+  return `${path5.basename(storePathFor(envName))}.refresh-result.`;
+}
+function parsePendingOAuthRefresh(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const refreshed = parsed.refreshed;
+    if (parsed.version !== 1 || typeof parsed.previousRefreshTokenHash !== "string" || !/^[a-f0-9]{64}$/.test(parsed.previousRefreshTokenHash) || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || !refreshed || typeof refreshed.accessToken !== "string" || typeof refreshed.refreshToken !== "string" || typeof refreshed.expiresAt !== "number" || !Number.isFinite(refreshed.expiresAt) || !refreshed.user || typeof refreshed.user.id !== "string" || typeof refreshed.user.email !== "string" || typeof refreshed.user.name !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function stagePendingOAuthRefresh(previousRefreshToken, refreshed, envName) {
+  ensureDir(envName);
+  const resultPath = `${storePathFor(envName)}.refresh-result.${Date.now()}.${randomUUID2()}.json`;
+  const pending = {
+    version: 1,
+    previousRefreshTokenHash: credentialHash(previousRefreshToken),
+    refreshed,
+    createdAtMs: Date.now()
+  };
+  writeSecretFile(resultPath, `${JSON.stringify(pending)}
+`);
+  return resultPath;
+}
+function removePendingOAuthRefresh(resultPath) {
+  try {
+    fs3.unlinkSync(resultPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      console.error(
+        `[fml] Auth: unable to remove a committed refresh result: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+}
+function reconcilePendingOAuthRefreshes(envName, unreadableStorePolicy = "preserve-staged") {
+  const storePath = storePathFor(envName);
+  const directory = path5.dirname(storePath);
+  const prefix = pendingOAuthRefreshPrefix(envName);
+  let resultPaths;
+  try {
+    resultPaths = fs3.readdirSync(directory).filter((entry) => entry.startsWith(prefix) && entry.endsWith(".json")).map((entry) => path5.join(directory, entry));
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  const pendingResults = resultPaths.map((resultPath) => {
+    let pending = null;
+    try {
+      pending = parsePendingOAuthRefresh(fs3.readFileSync(resultPath, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    return { resultPath, pending };
+  }).sort(
+    (left, right) => (left.pending?.createdAtMs ?? 0) - (right.pending?.createdAtMs ?? 0)
+  );
+  for (const { resultPath, pending } of pendingResults) {
+    if (!pending) {
+      removePendingOAuthRefresh(resultPath);
+      continue;
+    }
+    let current;
+    try {
+      current = readTokensForReconciliation(envName);
+    } catch (error) {
+      if (unreadableStorePolicy === "discard-staged" && error instanceof CorruptStoredCredentialsError) {
+        console.error(
+          `[fml] Auth: discarding a staged refresh result because the credential store is corrupt and is being replaced: ${error.message}`
+        );
+        removePendingOAuthRefresh(resultPath);
+        continue;
+      }
+      throw error;
+    }
+    if (current?.refreshToken === pending.refreshed.refreshToken || current && credentialHash(current.refreshToken) === pending.previousRefreshTokenHash) {
+      if (current.refreshToken !== pending.refreshed.refreshToken) {
+        writeTokensUnlocked(
+          {
+            ...pending.refreshed,
+            orgId: current.orgId,
+            orgSlug: current.orgSlug
+          },
+          envName
+        );
+      }
+    }
+    removePendingOAuthRefresh(resultPath);
+  }
+}
+function parseRefreshLockOwner(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || typeof parsed.ownerId !== "string" || parsed.ownerId.length === 0 || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || parsed.processIdentity !== void 0 && typeof parsed.processIdentity !== "string" || parsed.processInstanceId !== void 0 && typeof parsed.processInstanceId !== "string" || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || parsed.releasedAtMs !== void 0 && (typeof parsed.releasedAtMs !== "number" || !Number.isFinite(parsed.releasedAtMs))) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function getProcessIdentity(pid) {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs3.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const fieldsAfterCommand = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      const startTimeTicks = fieldsAfterCommand[19];
+      return startTimeTicks ? `linux:${startTimeTicks}` : null;
+    }
+    if (process.platform === "darwin") {
+      const startedAt = execFileSync(
+        "ps",
+        ["-p", String(pid), "-o", "lstart="],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 2e3
+        }
+      ).trim();
+      return startedAt ? `darwin:${startedAt}` : null;
+    }
+    if (process.platform === "win32") {
+      const startedAt = execFileSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().Ticks`
+        ],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 2e3
+        }
+      ).trim();
+      return startedAt ? `win32:${startedAt}` : null;
+    }
+  } catch {
+  }
+  return null;
+}
+function parseRecoveryMarkerOwner(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || typeof parsed.ownerId !== "string" || parsed.ownerId.length === 0 || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || parsed.processIdentity !== void 0 && typeof parsed.processIdentity !== "string" || parsed.processInstanceId !== void 0 && typeof parsed.processInstanceId !== "string" || typeof parsed.createdAtMs !== "number" || !Number.isFinite(parsed.createdAtMs) || parsed.releasedAtMs !== void 0 && (typeof parsed.releasedAtMs !== "number" || !Number.isFinite(parsed.releasedAtMs))) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function snapshotLeaseFile(filePath) {
+  let stat;
+  try {
+    stat = fs3.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (stat.isDirectory()) {
+    try {
+      return {
+        stat,
+        raw: fs3.readFileSync(path5.join(filePath, "owner.json"), "utf8")
+      };
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return { stat, raw: "" };
+      }
+      throw error;
+    }
+  }
+  try {
+    return { stat, raw: fs3.readFileSync(filePath, "utf8") };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function snapshotsMatch(observed, current) {
+  return current.stat.dev === observed.stat.dev && current.stat.ino === observed.stat.ino && current.stat.mtimeMs === observed.stat.mtimeMs && current.raw === observed.raw;
+}
+function restoreMovedLease(movedPath, originalPath) {
+  let movedStat;
+  try {
+    movedStat = fs3.lstatSync(movedPath);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  if (!movedStat.isFile()) return;
+  try {
+    fs3.linkSync(movedPath, originalPath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EEXIST" || code === "ENOENT") return;
+    throw error;
+  }
+  try {
+    fs3.unlinkSync(movedPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function pathMatchesClaim(filePath, claimedStat, ownerId, parseOwner) {
+  const current = snapshotLeaseFile(filePath);
+  return Boolean(
+    current && current.stat.dev === claimedStat.dev && current.stat.ino === claimedStat.ino && parseOwner(current.raw)?.ownerId === ownerId
+  );
+}
+function markClaimReleased(filePath, claimedStat, owner, parseOwner) {
+  let descriptor;
+  try {
+    descriptor = fs3.openSync(filePath, "r+");
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  try {
+    const currentStat = fs3.fstatSync(descriptor);
+    if (currentStat.dev !== claimedStat.dev || currentStat.ino !== claimedStat.ino) {
+      return false;
+    }
+    const currentOwner = parseOwner(fs3.readFileSync(descriptor, "utf8"));
+    if (currentOwner?.ownerId !== owner.ownerId) return false;
+    const serialized = Buffer.from(
+      `${JSON.stringify({ ...owner, releasedAtMs: Date.now() })}
+`,
+      "utf8"
+    );
+    fs3.ftruncateSync(descriptor, 0);
+    let offset = 0;
+    while (offset < serialized.length) {
+      offset += fs3.writeSync(
+        descriptor,
+        serialized,
+        offset,
+        serialized.length - offset,
+        offset
+      );
+    }
+    fs3.fsyncSync(descriptor);
+    return true;
+  } finally {
+    fs3.closeSync(descriptor);
+  }
+}
+function releaseOwnedLease(filePath, claimedStat, owner, parseOwner, description) {
+  const releasedPath = `${filePath}.released.${randomUUID2()}`;
+  let moved = false;
+  try {
+    if (!markClaimReleased(filePath, claimedStat, owner, parseOwner)) return;
+    try {
+      fs3.renameSync(filePath, releasedPath);
+      moved = true;
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    const released = snapshotLeaseFile(releasedPath);
+    const releasedOwner = released ? parseOwner(released.raw) : null;
+    if (!released || released.stat.dev !== claimedStat.dev || released.stat.ino !== claimedStat.ino || releasedOwner?.ownerId !== owner.ownerId || releasedOwner.releasedAtMs === void 0) {
+      restoreMovedLease(releasedPath, filePath);
+      moved = false;
+      return;
+    }
+    fs3.rmSync(releasedPath, {
+      recursive: released.stat.isDirectory(),
+      force: true
+    });
+    moved = false;
+  } catch (error) {
+    let restorationError;
+    if (moved) {
+      try {
+        restoreMovedLease(releasedPath, filePath);
+      } catch (restoreError) {
+        restorationError = restoreError;
+      }
+    }
+    console.error(
+      `[fml] Auth: unable to remove released ${description}: ${error instanceof Error ? error.message : String(error)}${restorationError ? `; unable to restore it: ${restorationError instanceof Error ? restorationError.message : String(restorationError)}` : ""}`
+    );
+  }
+}
+function sleep(milliseconds, signal) {
+  if (!signal) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+  }
+  if (signal.aborted) {
+    return Promise.reject(
+      signal.reason ?? new DOMException("The operation was aborted", "AbortError")
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, milliseconds);
+    const onAbort = () => {
+      clearTimeout(timeout);
+      cleanup();
+      reject(
+        signal.reason ?? new DOMException("The operation was aborted", "AbortError")
+      );
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var processIdentityChecks = /* @__PURE__ */ new Map();
+function ownerPidWasReused(owner, lockMtimeMs) {
+  const now = Date.now();
+  if (now - Math.max(owner.createdAtMs, lockMtimeMs) < PROCESS_IDENTITY_STALE_MS)
+    return false;
+  if (owner.pid === process.pid && owner.processInstanceId !== void 0) {
+    return owner.processInstanceId !== CURRENT_PROCESS_INSTANCE_ID;
+  }
+  if (!owner.processIdentity) return false;
+  const cached = processIdentityChecks.get(owner.ownerId);
+  let currentIdentity;
+  if (cached && now - cached.checkedAtMs < PROCESS_IDENTITY_RECHECK_MS) {
+    currentIdentity = cached.identity;
+  } else {
+    currentIdentity = getProcessIdentity(owner.pid);
+    processIdentityChecks.set(owner.ownerId, {
+      checkedAtMs: now,
+      identity: currentIdentity
+    });
+  }
+  return currentIdentity !== null && currentIdentity !== owner.processIdentity;
+}
+function writeClaimToDescriptor(descriptor, serializedOwner) {
+  const claimedStat = fs3.fstatSync(descriptor);
+  fs3.writeFileSync(descriptor, serializedOwner, { encoding: "utf8" });
+  fs3.fsyncSync(descriptor);
+  return claimedStat;
+}
+function recoverAbandonedRecoveryMarker(recoveryPath) {
+  const observed = snapshotLeaseFile(recoveryPath);
+  if (!observed) return;
+  const owner = parseRecoveryMarkerOwner(observed.raw);
+  const ownerAlive = owner ? isProcessAlive(owner.pid) : false;
+  const reclaimable = owner ? owner.releasedAtMs !== void 0 || !ownerAlive || ownerAlive && ownerPidWasReused(owner, observed.stat.mtimeMs) : Date.now() - observed.stat.mtimeMs > OAUTH_REFRESH_RECOVERY_STALE_MS;
+  if (!reclaimable) return;
+  const abandonedPath = `${recoveryPath}.stale.${randomUUID2()}`;
+  try {
+    fs3.renameSync(recoveryPath, abandonedPath);
+    const moved = snapshotLeaseFile(abandonedPath);
+    if (!moved || !snapshotsMatch(observed, moved)) {
+      restoreMovedLease(abandonedPath, recoveryPath);
+      return;
+    }
+    fs3.rmSync(abandonedPath, {
+      recursive: moved.stat.isDirectory(),
+      force: true
+    });
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function acquireRecoveryMarker(recoveryPath) {
+  const ownerId = randomUUID2();
+  const owner = {
+    version: 1,
+    ownerId,
+    pid: process.pid,
+    processIdentity: getCurrentProcessIdentity(),
+    processInstanceId: CURRENT_PROCESS_INSTANCE_ID,
+    createdAtMs: Date.now()
+  };
+  let descriptor;
+  try {
+    descriptor = fs3.openSync(recoveryPath, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  let claimedStat;
+  try {
+    claimedStat = writeClaimToDescriptor(
+      descriptor,
+      `${JSON.stringify(owner)}
+`
+    );
+  } finally {
+    fs3.closeSync(descriptor);
+  }
+  const isOwned = () => pathMatchesClaim(
+    recoveryPath,
+    claimedStat,
+    ownerId,
+    parseRecoveryMarkerOwner
+  );
+  if (!isOwned()) return null;
+  let released = false;
+  return {
+    isOwned,
+    release: () => {
+      if (released) return;
+      released = true;
+      if (isOwned()) {
+        releaseOwnedLease(
+          recoveryPath,
+          claimedStat,
+          owner,
+          parseRecoveryMarkerOwner,
+          "credential-lock recovery marker"
+        );
+      }
+    }
+  };
+}
+function recoverStaleRefreshLock(lockPath) {
+  const recoveryPath = `${lockPath}.recovery`;
+  const recovery = acquireRecoveryMarker(recoveryPath);
+  if (!recovery) return;
+  try {
+    const observed = snapshotLeaseFile(lockPath);
+    if (!observed) return;
+    let reclaimable;
+    const owner = parseRefreshLockOwner(observed.raw);
+    if (owner) {
+      const alive = isProcessAlive(owner.pid);
+      reclaimable = owner.releasedAtMs !== void 0 || !alive || alive && ownerPidWasReused(owner, observed.stat.mtimeMs);
+    } else {
+      reclaimable = Date.now() - observed.stat.mtimeMs > OAUTH_REFRESH_LOCK_STALE_MS;
+    }
+    if (!reclaimable) return;
+    if (!recovery.isOwned()) return;
+    const abandonedPath = `${lockPath}.stale.${randomUUID2()}`;
+    try {
+      fs3.renameSync(lockPath, abandonedPath);
+      const moved = snapshotLeaseFile(abandonedPath);
+      if (!moved || !snapshotsMatch(observed, moved)) {
+        restoreMovedLease(abandonedPath, lockPath);
+        return;
+      }
+      fs3.rmSync(abandonedPath, {
+        recursive: moved.stat.isDirectory(),
+        force: true
+      });
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  } finally {
+    recovery.release();
+  }
+}
+async function acquireRefreshLock(envName, signal) {
+  try {
+    ensureDir(envName);
+  } catch (error) {
+    console.error(
+      `[fml] Auth: unable to prepare refresh lock: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return null;
+  }
+  const lockPath = refreshLockPath(envName);
+  const recoveryPath = `${lockPath}.recovery`;
+  const deadline = Date.now() + OAUTH_REFRESH_LOCK_WAIT_MS;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) {
+      throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+    }
+    if (fs3.existsSync(recoveryPath)) {
+      try {
+        recoverAbandonedRecoveryMarker(recoveryPath);
+      } catch (recoveryError) {
+        console.error(
+          `[fml] Auth: unable to recover refresh recovery marker: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`
+        );
+        return null;
+      }
+      await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
+      continue;
+    }
+    let descriptor;
+    try {
+      descriptor = fs3.openSync(lockPath, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        console.error(
+          `[fml] Auth: unable to acquire refresh lock: ${error instanceof Error ? error.message : String(error)}`
+        );
+        return null;
+      }
+      try {
+        recoverStaleRefreshLock(lockPath);
+      } catch (recoveryError) {
+        console.error(
+          `[fml] Auth: unable to recover refresh lock: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`
+        );
+        return null;
+      }
+      await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
+      continue;
+    }
+    const ownerId = randomUUID2();
+    const owner = {
+      version: 1,
+      ownerId,
+      pid: process.pid,
+      processIdentity: getCurrentProcessIdentity(),
+      processInstanceId: CURRENT_PROCESS_INSTANCE_ID,
+      createdAtMs: Date.now()
+    };
+    let claimedStat;
+    try {
+      claimedStat = writeClaimToDescriptor(
+        descriptor,
+        `${JSON.stringify(owner)}
+`
+      );
+    } catch (error) {
+      fs3.closeSync(descriptor);
+      console.error(
+        `[fml] Auth: unable to initialize refresh lock: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return null;
+    }
+    fs3.closeSync(descriptor);
+    const isOwned = () => pathMatchesClaim(lockPath, claimedStat, ownerId, parseRefreshLockOwner);
+    const releaseClaim = () => releaseOwnedLease(
+      lockPath,
+      claimedStat,
+      owner,
+      parseRefreshLockOwner,
+      "credential lock"
+    );
+    if (signal?.aborted) {
+      releaseClaim();
+      throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+    }
+    let entryBlocked;
+    try {
+      entryBlocked = fs3.existsSync(recoveryPath) || !isOwned();
+    } catch (error) {
+      console.error(
+        `[fml] Auth: unable to verify refresh lock ownership: ${describeError(error)}`
+      );
+      try {
+        if (isOwned()) releaseClaim();
+      } catch {
+      }
+      return null;
+    }
+    if (entryBlocked) {
+      try {
+        await sleep(OAUTH_REFRESH_LOCK_POLL_MS, signal);
+      } finally {
+        try {
+          if (isOwned()) releaseClaim();
+        } catch (error) {
+          console.error(
+            `[fml] Auth: unable to release a blocked refresh lock claim: ${describeError(error)}`
+          );
+        }
+      }
+      continue;
+    }
+    let released = false;
+    return {
+      isOwned,
+      release: () => {
+        if (released) return;
+        released = true;
+        let owned = false;
+        try {
+          owned = isOwned();
+        } catch (error) {
+          console.error(
+            `[fml] Auth: unable to verify credential lock ownership during release: ${describeError(error)}`
+          );
+        }
+        if (owned) releaseClaim();
+      }
+    };
+  }
+  console.error(
+    (() => {
+      try {
+        const owner = snapshotLeaseFile(lockPath);
+        const parsedOwner = owner ? parseRefreshLockOwner(owner.raw) : null;
+        return parsedOwner && isProcessAlive(parsedOwner.pid) ? `[fml] Auth: credential lock is still owned by live process ${parsedOwner.pid}; refusing an unsafe takeover` : "[fml] Auth: timed out waiting for another process to refresh credentials";
+      } catch {
+        return "[fml] Auth: timed out waiting for another process to refresh credentials";
+      }
+    })()
+  );
+  return null;
+}
+function isLockOwnedSafely(lock) {
+  try {
+    return lock.isOwned();
+  } catch (error) {
+    console.error(
+      `[fml] Auth: unable to verify credential lock ownership: ${describeError(error)}`
+    );
+    return false;
+  }
+}
+async function withRefreshLock(envName, mutation, options) {
+  const lock = await acquireRefreshLock(envName, options?.signal);
+  if (!lock) {
+    throw new Error("Unable to acquire the credential mutation lock");
+  }
+  try {
+    if (!isLockOwnedSafely(lock)) {
+      throw new Error("Credential mutation lock ownership was lost");
+    }
+    reconcilePendingOAuthRefreshes(envName, options?.unreadableStorePolicy);
+    if (!isLockOwnedSafely(lock)) {
+      throw new Error("Credential mutation lock ownership was lost");
+    }
+    const result = await mutation(lock);
+    if (!isLockOwnedSafely(lock)) {
+      throw new Error("Credential mutation lock ownership was lost");
+    }
+    return result;
+  } finally {
+    lock.release();
+  }
+}
+async function refreshServiceToken(refreshToken2, envName, siteUrl, signal) {
+  try {
+    if (signal?.aborted) return null;
+    const convexUrl = (envName ? resolveEnvConvexUrl(envName) : null) ?? CONVEX_URL;
+    const requestTimeout = AbortSignal.timeout(
+      OAUTH_REFRESH_REQUEST_TIMEOUT_MS
+    );
+    const response = await fetch(
+      `${siteUrl ?? getSiteUrlForConvexUrl(convexUrl)}/api/tokens/refresh`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${refreshToken2}`
+        },
+        signal: signal ? AbortSignal.any([signal, requestTimeout]) : requestTimeout
+      }
+    );
+    if (!response.ok) {
+      console.error(
+        `[fml] Service token refresh failed: HTTP ${response.status}`
+      );
+      return null;
+    }
+    const data = await response.json();
+    if (!data.ok || !data.accessToken) {
+      console.error(`[fml] Service token refresh error: ${data.error}`);
+      return null;
+    }
+    serviceTokenCaches.set(cacheKey(envName), {
+      accessToken: data.accessToken,
+      expiresAt: data.expiresAt
+    });
+    return data.accessToken;
+  } catch (err) {
+    if (signal?.aborted) return null;
+    Sentry.captureException(err);
+    console.error(`[fml] Service token refresh error: ${err}`);
+    return null;
+  }
+}
+async function getValidToken(opts) {
+  if (opts?.signal?.aborted) return null;
+  const envName = resolveEnvName(opts?.env);
+  const forceRefresh = opts?.forceRefresh === true;
+  const key = cacheKey(envName);
+  const envToken = process.env.FML_TOKEN;
+  if (envToken?.startsWith("fml_srt_")) {
+    const cached = serviceTokenCaches.get(key);
+    if (!forceRefresh && cached && cached.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+      return cached.accessToken;
+    }
+    return await getOrStartTokenRefresh(
+      serviceRefreshPromises,
+      key,
+      forceRefresh,
+      () => refreshServiceToken(envToken, envName, void 0, opts?.signal),
+      opts?.signal
+    );
+  }
+  if (envToken?.startsWith("fml_st_")) return envToken;
+  if (envToken) {
+    console.error(
+      "[fml] Auth: unsupported FML_TOKEN format. Expected fml_srt_* or fml_st_*."
+    );
+    return null;
+  }
+  const stored = readTokens(envName);
+  if (!stored) {
+    console.error(
+      envName ? `[fml] Auth: no stored tokens for env "${envName}"` : "[fml] Auth: no stored tokens"
+    );
+    return null;
+  }
+  if (!forceRefresh && stored.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+    return stored.accessToken;
+  }
+  if (stored.tokenType === "service") {
+    return await getOrStartTokenRefresh(
+      serviceRefreshPromises,
+      key,
+      forceRefresh,
+      () => withRefreshLock(
+        envName,
+        async (lock) => {
+          const current = readTokens(envName);
+          if (!current) return null;
+          if (!forceRefresh && current.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+            return current.accessToken;
+          }
+          if (current.tokenType !== "service") {
+            return current.accessToken;
+          }
+          if (!lock.isOwned()) return null;
+          const newAccessToken = await refreshServiceToken(
+            current.refreshToken,
+            envName,
+            void 0,
+            opts?.signal
+          );
+          if (!lock.isOwned()) return null;
+          const cached = serviceTokenCaches.get(key);
+          if (newAccessToken && cached) {
+            writeTokensUnlocked(
+              {
+                ...current,
+                accessToken: newAccessToken,
+                expiresAt: cached.expiresAt
+              },
+              envName
+            );
+          }
+          return newAccessToken;
+        },
+        { signal: opts?.signal }
+      ).catch((error) => {
+        if (opts?.signal?.aborted) return null;
+        console.error(
+          `[fml] Auth: unable to refresh stored service credentials: ${error instanceof Error ? error.message : String(error)}`
+        );
+        return null;
+      }),
+      opts?.signal
+    );
+  }
+  if (stored.refreshInvalidAt) {
+    console.error(
+      "[fml] Auth: refresh token is no longer valid \u2014 run `fml login`"
+    );
+    return null;
+  }
+  return await getOrStartTokenRefresh(
+    oauthRefreshPromises,
+    key,
+    forceRefresh,
+    () => refreshTokenWithLock(envName, forceRefresh, opts?.signal),
+    opts?.signal
+  );
+}
+async function refreshTokenWithLock(envName, forceRefresh = false, signal) {
+  const lock = await acquireRefreshLock(envName, signal);
+  if (!lock) return null;
+  try {
+    if (!isLockOwnedSafely(lock)) return null;
+    try {
+      reconcilePendingOAuthRefreshes(envName);
+    } catch (error) {
+      console.error(
+        `[fml] Auth: unable to reconcile staged refresh results: ${describeError(error)}`
+      );
+      return null;
+    }
+    if (!isLockOwnedSafely(lock)) return null;
+    const current = readTokens(envName);
+    if (!current) {
+      console.error("[fml] Auth: credentials disappeared during refresh");
+      return null;
+    }
+    if (!forceRefresh && current.expiresAt > Date.now() + TOKEN_REFRESH_WINDOW_MS) {
+      return current.accessToken;
+    }
+    if (current.refreshInvalidAt) {
+      console.error(
+        "[fml] Auth: refresh token is no longer valid \u2014 run `fml login`"
+      );
+      return null;
+    }
+    if (current.tokenType === "service") {
+      return null;
+    }
+    if (!isLockOwnedSafely(lock)) return null;
+    return await refreshToken(current, lock, envName, signal);
+  } finally {
+    lock.release();
+  }
+}
+async function refreshToken(stored, lock, envName, signal) {
+  if (!stored.workosClientId) {
+    console.error(
+      "[fml] Auth: token expired, missing workosClientId \u2014 run `fml login`"
+    );
+    return null;
+  }
+  try {
+    if (signal?.aborted) return null;
+    if (!lock.isOwned()) return null;
+    const requestTimeout = AbortSignal.timeout(
+      OAUTH_REFRESH_REQUEST_TIMEOUT_MS
+    );
+    const response = await fetch(
+      `${WORKOS_API_URL}/user_management/authenticate`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          client_id: stored.workosClientId,
+          refresh_token: stored.refreshToken
+        }),
+        signal: signal ? AbortSignal.any([signal, requestTimeout]) : requestTimeout
+      }
+    );
+    if (!response.ok) {
+      if (!lock.isOwned()) return null;
+      let oauthError = null;
+      try {
+        const errorBody = await response.json();
+        if (errorBody && typeof errorBody === "object" && "error" in errorBody && typeof errorBody.error === "string") {
+          oauthError = errorBody.error;
+        }
+      } catch {
+      }
+      if (oauthError === "invalid_grant") {
+        const current2 = readTokens(envName);
+        if (lock.isOwned() && current2?.refreshToken === stored.refreshToken) {
+          writeTokensUnlocked(
+            { ...current2, refreshInvalidAt: Date.now() },
+            envName
+          );
+        }
+        console.error(
+          "[fml] Auth: refresh token is no longer valid \u2014 run `fml login`"
+        );
+        return null;
+      }
+      console.error(
+        `[fml] Auth: refresh failed (HTTP ${response.status}) \u2014 token preserved`
+      );
+      return null;
+    }
+    const data = await response.json();
+    const userName = [data.user.first_name, data.user.last_name].filter(Boolean).join(" ");
+    const refreshed = {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      expiresAt: Date.now() + (data.expires_in ?? 300) * 1e3,
+      user: {
+        id: data.user.id,
+        email: data.user.email,
+        name: userName || stored.user.name
+      },
+      orgId: stored.orgId,
+      orgSlug: stored.orgSlug,
+      workosClientId: stored.workosClientId
+    };
+    const pendingPath = stagePendingOAuthRefresh(
+      stored.refreshToken,
+      refreshed,
+      envName
+    );
+    const current = readTokens(envName);
+    if (current?.refreshToken === stored.refreshToken && lock.isOwned()) {
+      writeTokensUnlocked(
+        {
+          ...refreshed,
+          orgId: current.orgId,
+          orgSlug: current.orgSlug
+        },
+        envName
+      );
+      removePendingOAuthRefresh(pendingPath);
+      return refreshed.accessToken;
+    }
+    if (!current) return null;
+    if (current.refreshToken !== stored.refreshToken) {
+      return current.accessToken;
+    }
+    return refreshed.accessToken;
+  } catch (err) {
+    if (signal?.aborted) return null;
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[fml] Auth: refresh failed (network error: ${msg}) \u2014 token preserved`
+    );
+    Sentry.captureException(err);
+    return null;
+  }
+}
+
+// src/repo.ts
+import { execFile, execFileSync as execFileSync2 } from "node:child_process";
+var REPO_CACHE = /* @__PURE__ */ new Map();
+var GIT_TIMEOUT_MS = 5e3;
+function cachedRepo(cwd) {
+  const entry = REPO_CACHE.get(cwd);
+  if (!entry) return { hit: false };
+  if (entry.expiresAtMs <= Date.now()) {
+    REPO_CACHE.delete(cwd);
+    return { hit: false };
+  }
+  REPO_CACHE.delete(cwd);
+  REPO_CACHE.set(cwd, entry);
+  return { hit: true, value: entry.value };
+}
+function git(cwd, args, timeoutMs) {
+  try {
+    return execFileSync2("git", ["-C", cwd, ...args], {
+      encoding: "utf8",
+      timeout: timeoutMs,
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function repositorySlug(remote) {
+  const ssh = remote.match(/^[^@]+@[^:]+:([^/]+\/[^/]+?)(?:\.git)?$/);
+  if (ssh?.[1]) return ssh[1];
+  try {
+    const url = new URL(remote);
+    const slug = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+    return /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(slug) ? slug : null;
+  } catch {
+    return null;
+  }
+}
+function resolveRepositorySlugFromCwd(cwd, timeoutMs = GIT_TIMEOUT_MS) {
+  const cached = cachedRepo(cwd);
+  if (cached.hit) return cached.value?.repo ?? null;
+  const remote = git(cwd, ["remote", "get-url", "origin"], timeoutMs);
+  return remote ? repositorySlug(remote) : null;
+}
+function resolveRepositoryRootFromCwd(cwd, timeoutMs = GIT_TIMEOUT_MS) {
+  return git(cwd, ["rev-parse", "--show-toplevel"], timeoutMs);
+}
+
+// src/hooks/sync-loop.ts
+var MAX_RETRY_INTERVAL_MS = 5 * 6e4;
+var MAX_RETRY_AFTER_MS = 24 * 60 * 6e4;
+var MAX_HOOK_EVENT_ROW_JSON_BYTES = 2 * 1024 * 1024;
+var MAX_SESSION_ROW_JSON_BYTES = 2 * 1024 * 1024;
+var MAX_BATCH_JSON_BYTES = 3 * 1024 * 1024;
+var MAX_EXTRACTED_TEXT_BYTES2 = 64 * 1024;
+var MAX_CONTEXT_TEXT_BYTES = 16 * 1024;
+var MAX_REJECTION_REASON_BYTES = 3 * 1024;
+function activeHookDestinationSnapshot() {
+  const environment = getActiveEnv();
+  const destinationIdentity = getSyncDestinationIdentity(environment.name);
+  if (!destinationIdentity) {
+    return { kind: "unauthenticated", environment: environment.name };
+  }
+  return {
+    kind: "ready",
+    binding: {
+      environment: environment.name,
+      targetUrl: getSiteUrlForConvexUrl(environment.convexUrl),
+      destinationIdentity
+    }
+  };
+}
+function getActiveHookDestinationBinding() {
+  const snapshot = activeHookDestinationSnapshot();
+  return snapshot.kind === "ready" ? snapshot.binding : null;
+}
+
+// src/hooks/context.ts
+var HOOK_CONTEXT_ENDPOINT = "/v1/panopticon/hook-context";
+var HOOK_CONTEXT_TIMEOUT_MS = 2e3;
+var MAX_ADDITIONAL_CONTEXT_CHARS = 3700;
+var MAX_RECEIPT_ITEMS = 5;
+var MAX_RECEIPT_LABEL_CHARS = 48;
+var MAX_RECEIPT_SUMMARY_CHARS = 240;
+var MAX_RECEIPT_PRIORITY = 100;
+var MAX_RECEIPT_TIMESTAMP_MS = 864e13;
+var MAX_RENDERED_RECEIPT_ITEMS = 3;
+var MODEL_CONTEXT_GUIDANCE = "If this FML context materially informs your work, naturally mention FML, the specific context used, and how it informed your work in the final response. Otherwise, do not mention it. Do not claim causal impact or time savings.";
+var CONTEXT_GUIDANCE_SEPARATOR = "\n\n";
+var STATE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var INJECTION_ID_VERSION = "v1";
+var EDIT_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "apply_patch",
+  "edit",
+  "multiedit",
+  "notebookedit",
+  "write",
+  "write_file"
+]);
+var READ_TOOL_NAMES = /* @__PURE__ */ new Set(["read", "read_file"]);
+function hookContextFileOperation(toolName) {
+  const normalizedToolName = toolName.toLowerCase();
+  if (EDIT_TOOL_NAMES.has(normalizedToolName)) return "edit";
+  if (READ_TOOL_NAMES.has(normalizedToolName) || SHELL_TOOL_NAMES.has(normalizedToolName)) {
+    return "read";
+  }
+  return null;
+}
+function extractHookContextFileTrigger(toolName, input) {
+  const fileOperation = hookContextFileOperation(toolName);
+  if (!fileOperation || !input || typeof input !== "object" || Array.isArray(input)) {
+    return null;
+  }
+  const record = input;
+  const directPath = record.file_path ?? record.filePath ?? record.path;
+  if (typeof directPath === "string" && directPath.length > 0) {
+    return { filePath: directPath, fileOperation };
+  }
+  if (!SHELL_TOOL_NAMES.has(toolName.toLowerCase())) return null;
+  const command = record.command ?? record.cmd;
+  if (typeof command !== "string") return null;
+  const filePath = extractReadFilePathFromCommand(command);
+  return filePath ? { filePath, fileOperation } : null;
+}
+function sameDestination(left, right) {
+  return left.environment === right.environment && left.targetUrl === right.targetUrl && left.destinationIdentity === right.destinationIdentity;
+}
+function hookContextInjectionId(target, syncId) {
+  const digest = createHash3("sha256").update(`${INJECTION_ID_VERSION}\0${target}\0${syncId}`).digest("base64url");
+  return `${INJECTION_ID_VERSION}_${digest}`;
+}
+function canonicalHookContextFilePath(filePath, cwd, repositoryRoot) {
+  const windows = [filePath, cwd, repositoryRoot].some(
+    (value) => value !== void 0 && value !== null && /^[A-Za-z]:[\\/]/.test(value)
+  );
+  const pathApi = windows ? path6.win32 : path6.posix;
+  const normalized = pathApi.normalize(filePath);
+  const resolved = pathApi.isAbsolute(normalized) ? normalized : cwd && pathApi.isAbsolute(cwd) ? pathApi.resolve(cwd, normalized) : normalized;
+  if (repositoryRoot && pathApi.isAbsolute(resolved)) {
+    const relative2 = pathApi.relative(
+      pathApi.normalize(repositoryRoot),
+      resolved
+    );
+    if (relative2 && relative2 !== ".." && !relative2.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative2)) {
+      return relative2.replace(/\\/g, "/");
+    }
+  }
+  if (!pathApi.isAbsolute(resolved)) {
+    return resolved.replace(/^[.][\\/]/, "").replace(/\\/g, "/");
+  }
+  if (!cwd || pathApi.isAbsolute(cwd) !== pathApi.isAbsolute(resolved)) {
+    return resolved.replace(/\\/g, "/");
+  }
+  const relative = pathApi.relative(pathApi.normalize(cwd), resolved);
+  if (relative && relative !== ".." && !relative.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative)) {
+    return relative.replace(/\\/g, "/");
+  }
+  return resolved.replace(/\\/g, "/");
+}
+var RECEIPT_LABELS = /* @__PURE__ */ new Set([
+  "Recent work",
+  "Relevant history",
+  "File history",
+  "Related files"
+]);
+function isSanitizedInlineText(value, maxChars) {
+  return value.length > 0 && value.length <= maxChars && !/[\u0000-\u001F\u007F-\u009F\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/u.test(
+    value
+  ) && value === value.replace(/\s+/g, " ").trim();
+}
+function isReceiptItem(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const item = value;
+  return typeof item.label === "string" && RECEIPT_LABELS.has(item.label) && isSanitizedInlineText(item.label, MAX_RECEIPT_LABEL_CHARS) && typeof item.summary === "string" && isSanitizedInlineText(item.summary, MAX_RECEIPT_SUMMARY_CHARS) && typeof item.priority === "number" && Number.isSafeInteger(item.priority) && item.priority >= 0 && item.priority <= MAX_RECEIPT_PRIORITY && (item.occurredAtMs === void 0 || typeof item.occurredAtMs === "number" && Number.isSafeInteger(item.occurredAtMs) && item.occurredAtMs >= 0 && item.occurredAtMs <= MAX_RECEIPT_TIMESTAMP_MS);
+}
+function receiptItemsFromResponse(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.length > MAX_RECEIPT_ITEMS) return null;
+  if (!value.every(isReceiptItem)) return null;
+  return value;
+}
+var RECEIPT_LINE_WIDTH = 88;
+var RECEIPT_SEGMENTER = new Intl.Segmenter(void 0, {
+  granularity: "grapheme"
+});
+function isFullWidthCodePoint(codePoint) {
+  return codePoint >= 4352 && (codePoint <= 4447 || codePoint === 9001 || codePoint === 9002 || codePoint >= 11904 && codePoint <= 42191 && codePoint !== 12351 || codePoint >= 44032 && codePoint <= 55203 || codePoint >= 63744 && codePoint <= 64255 || codePoint >= 65040 && codePoint <= 65049 || codePoint >= 65072 && codePoint <= 65135 || codePoint >= 65280 && codePoint <= 65376 || codePoint >= 65504 && codePoint <= 65510 || // Supplementary CJK-adjacent scripts and Japanese kana are rendered
+  // double-width by terminals. Keep these deliberately conservative:
+  // wrapping early is safer than emitting a line beyond the receipt bound.
+  codePoint >= 94176 && codePoint <= 94207 || codePoint >= 94208 && codePoint <= 100351 || codePoint >= 100352 && codePoint <= 101887 || codePoint >= 110592 && codePoint <= 111359 || codePoint >= 127488 && codePoint <= 127569 || codePoint >= 131072 && codePoint <= 262141);
+}
+function isDefaultIgnorableOrMark(value) {
+  return /^[\p{Mark}\p{Default_Ignorable_Code_Point}]+$/u.test(value);
+}
+function isEmojiGrapheme(value) {
+  return new RegExp("\\p{Extended_Pictographic}", "u").test(value) || /[\u{1F1E6}-\u{1F1FF}]/u.test(value) || value.includes("\u20E3");
+}
+function receiptDisplayWidth(value) {
+  let width = 0;
+  for (const { segment } of RECEIPT_SEGMENTER.segment(value)) {
+    if (isDefaultIgnorableOrMark(segment)) continue;
+    if (isEmojiGrapheme(segment)) {
+      width += 2;
+      continue;
+    }
+    const codePoints = [...segment].map(
+      (character) => character.codePointAt(0)
+    );
+    width += codePoints.some(
+      (codePoint) => codePoint !== void 0 && isFullWidthCodePoint(codePoint)
+    ) ? 2 : 1;
+  }
+  return width;
+}
+function takeGraphemesToWidth(value, maxWidth) {
+  let rendered = "";
+  let renderedWidth = 0;
+  for (const { segment } of RECEIPT_SEGMENTER.segment(value)) {
+    const segmentWidth = receiptDisplayWidth(segment);
+    if (renderedWidth + segmentWidth > maxWidth) break;
+    rendered += segment;
+    renderedWidth += segmentWidth;
+  }
+  return rendered;
+}
+function splitAtDisplayWidth(value, maxWidth) {
+  let renderedWidth = 0;
+  let end = 0;
+  let lastWhitespaceEnd = 0;
+  for (const { segment, index } of RECEIPT_SEGMENTER.segment(value)) {
+    const segmentWidth = receiptDisplayWidth(segment);
+    if (renderedWidth + segmentWidth > maxWidth) break;
+    renderedWidth += segmentWidth;
+    end = index + segment.length;
+    if (/^\s$/u.test(segment)) lastWhitespaceEnd = end;
+  }
+  if (end === value.length) return { head: value, tail: "" };
+  if (lastWhitespaceEnd > 0) {
+    return {
+      head: value.slice(0, lastWhitespaceEnd).trimEnd(),
+      tail: value.slice(lastWhitespaceEnd).trimStart()
+    };
+  }
+  return { head: value.slice(0, end), tail: value.slice(end) };
+}
+function isSafeInlineCode(value) {
+  if (!/^[A-Za-z0-9@._/$-]+$/u.test(value)) return false;
+  const segments = value.split("/");
+  if (segments.some(
+    (segment) => segment === "" || segment === "." || segment === ".."
+  )) {
+    return false;
+  }
+  return value.includes("/") || /^[^.]+\.[A-Za-z0-9_-]+$/u.test(value) || /^[A-Za-z_$][A-Za-z0-9_$]*$/u.test(value);
+}
+function removeMarkdownEmphasis(value) {
+  return value.replace(/(\*\*|__)(.+?)\1/gu, "$2").replace(/~~(.+?)~~/gu, "$1").replace(/(?<!\w)\*([^*]+)\*(?!\w)/gu, "$1").replace(/(?<!\w)_([^_]+)_(?!\w)/gu, "$1");
+}
+var UNSAFE_RECEIPT_CHARACTERS = /[\u0000-\u001F\u007F-\u009F\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/gu;
+var HTML_CHARACTER_REFERENCE = /&(?:#(?:[xX][0-9A-Fa-f]+|\d+)|[A-Za-z][A-Za-z0-9]+);/gu;
+function renderReceiptPlainText(value) {
+  return removeMarkdownEmphasis(value).replace(HTML_CHARACTER_REFERENCE, "character reference").replace(/\\([\\`*_{}\[\]<>()[\]#+\-=!|])/gu, "$1").replace(/`/gu, "");
+}
+function renderReceiptSummary(summary) {
+  const withoutLinks = summary.replace(UNSAFE_RECEIPT_CHARACTERS, "").replace(/!?\[([^\]]*)\]\([^)]*\)/gu, "$1").replace(/!?\[([^\]]*)\]\[[^\]]*\]/gu, "$1").replace(/<https?:\/\/[^>\s]+>/gu, "link").replace(/https?:\/\/[^\s<>()]+/gu, "link").replace(/<[^>]*>/gu, "");
+  let rendered = "";
+  let cursor = 0;
+  for (const match of withoutLinks.matchAll(/`([^`\r\n]+)`/gu)) {
+    const matchIndex = match.index ?? 0;
+    rendered += renderReceiptPlainText(withoutLinks.slice(cursor, matchIndex));
+    const content = match[1] ?? "";
+    rendered += isSafeInlineCode(content) ? `\`${content}\`` : renderReceiptPlainText(content);
+    cursor = matchIndex + match[0].length;
+  }
+  return `${rendered}${renderReceiptPlainText(withoutLinks.slice(cursor))}`.replace(/\s+/gu, " ").trim();
+}
+function truncateInlineCodeToken(token, maxWidth) {
+  const content = token.slice(1, -1);
+  const ellipsisWidth = receiptDisplayWidth("\u2026");
+  const contentWidth = maxWidth - 2 - ellipsisWidth;
+  if (contentWidth < 1) return "";
+  return `\`${takeGraphemesToWidth(content, contentWidth)}\u2026\``;
+}
+function splitInlineCodeToken(token) {
+  const match = /^(`[^`]+`)([.,;:!?)}\]]*)$/u.exec(token);
+  if (!match) return null;
+  return {
+    inlineCode: match[1] ?? "",
+    trailingPunctuation: match[2] ?? ""
+  };
+}
+function wrapReceiptDetail(label, detail) {
+  const firstPrefix = `\u2502 ${label}: `;
+  const continuationPrefix = "\u2502   ";
+  const lines = [];
+  let remaining = detail;
+  let prefix = firstPrefix;
+  while (remaining) {
+    const available = RECEIPT_LINE_WIDTH - receiptDisplayWidth(prefix);
+    if (receiptDisplayWidth(remaining) <= available) {
+      lines.push(`${prefix}${remaining}`);
+      break;
+    }
+    const tokenEnd = remaining.search(/\s/u);
+    const token = tokenEnd === -1 ? remaining : remaining.slice(0, tokenEnd);
+    const inlineCodeToken = splitInlineCodeToken(token);
+    const inlineCodeWidth = inlineCodeToken ? receiptDisplayWidth(inlineCodeToken.inlineCode) + receiptDisplayWidth(inlineCodeToken.trailingPunctuation) : 0;
+    if (inlineCodeToken && inlineCodeWidth > available) {
+      const codeWidth = available - receiptDisplayWidth(inlineCodeToken.trailingPunctuation);
+      if (codeWidth >= 3) {
+        lines.push(
+          `${prefix}${truncateInlineCodeToken(
+            inlineCodeToken.inlineCode,
+            codeWidth
+          )}${inlineCodeToken.trailingPunctuation}`
+        );
+        remaining = tokenEnd === -1 ? "" : remaining.slice(tokenEnd).trimStart();
+      } else {
+        lines.push(
+          `${prefix}${truncateInlineCodeToken(
+            inlineCodeToken.inlineCode,
+            available
+          )}`
+        );
+        remaining = `${inlineCodeToken.trailingPunctuation}${tokenEnd === -1 ? "" : ` ${remaining.slice(tokenEnd).trimStart()}`}`;
+      }
+    } else {
+      const { head, tail } = splitAtDisplayWidth(remaining, available);
+      if (!head) return [];
+      lines.push(`${prefix}${head}`);
+      remaining = tail;
+    }
+    prefix = continuationPrefix;
+  }
+  return lines;
+}
+function formatReceiptTime(occurredAtMs, nowMs) {
+  const elapsedMs = nowMs - occurredAtMs;
+  const dayMs = 24 * 60 * 60 * 1e3;
+  if (elapsedMs >= 0 && elapsedMs < 30 * dayMs) {
+    const days = Math.floor(elapsedMs / dayMs);
+    if (days === 0) return "today";
+    if (days === 1) return "yesterday";
+    if (days < 7) return `${days} days ago`;
+    const weeks = Math.floor(days / 7);
+    return `${weeks} week${weeks === 1 ? "" : "s"} ago`;
+  }
+  try {
+    return new Intl.DateTimeFormat(void 0, {
+      month: "short",
+      day: "numeric",
+      year: "numeric"
+    }).format(new Date(occurredAtMs));
+  } catch {
+    return "";
+  }
+}
+function renderHookContextReceipt(receiptItems, nowMs) {
+  try {
+    const displayedDetails = [];
+    for (const { item } of receiptItems.map((item2, index) => ({ item: item2, index })).sort(
+      (left, right) => right.item.priority - left.item.priority || left.index - right.index
+    )) {
+      const summary = renderReceiptSummary(item.summary);
+      if (!summary) continue;
+      const time = item.occurredAtMs === void 0 ? "" : formatReceiptTime(item.occurredAtMs, nowMs);
+      const detailLines = wrapReceiptDetail(
+        item.label,
+        `${summary}${time ? ` (${time})` : ""}`
+      );
+      if (detailLines.length === 0) continue;
+      displayedDetails.push(detailLines);
+      if (displayedDetails.length === MAX_RENDERED_RECEIPT_ITEMS) break;
+    }
+    const displayedItemCount = displayedDetails.length;
+    const remainingItemCount = receiptItems.length - displayedItemCount;
+    return receiptItems.length > 0 ? [
+      "",
+      "\u256D\u2500 FML provided context:",
+      ...displayedDetails.flat(),
+      ...remainingItemCount > 0 ? [
+        `\u2502 +${remainingItemCount} more context item${remainingItemCount === 1 ? "" : "s"}`
+      ] : [],
+      "\u2570\u2500"
+    ].join("\n") : null;
+  } catch {
+    return null;
+  }
+}
+function appendModelContextGuidance(additionalContext) {
+  return `${additionalContext}${CONTEXT_GUIDANCE_SEPARATOR}${MODEL_CONTEXT_GUIDANCE}`;
+}
+async function requestServerHookContextInjection(request, destination, opts = {}) {
+  const deadlineSignal = AbortSignal.timeout(
+    opts.timeoutMs ?? HOOK_CONTEXT_TIMEOUT_MS
+  );
+  try {
+    const token = await getValidToken({
+      env: destination.environment,
+      signal: deadlineSignal
+    });
+    if (!token) return null;
+    const currentDestination = getActiveHookDestinationBinding();
+    if (!currentDestination || !sameDestination(destination, currentDestination)) {
+      return null;
+    }
+    const response = await (opts.fetch ?? fetch)(
+      `${destination.targetUrl.replace(/\/+$/, "")}${HOOK_CONTEXT_ENDPOINT}`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: token.startsWith("Bearer ") ? token : `Bearer ${token}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(request),
+        signal: deadlineSignal
+      }
+    );
+    if (!response.ok) return null;
+    const body = await response.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+    const responseBody = body;
+    const additionalContext = responseBody.additionalContext;
+    if (additionalContext === null) {
+      return { additionalContext: null, receipt: null };
+    }
+    if (typeof additionalContext !== "string" || additionalContext.length === 0 || additionalContext.length > MAX_ADDITIONAL_CONTEXT_CHARS) {
+      return null;
+    }
+    const receiptItems = receiptItemsFromResponse(responseBody.receiptItems);
+    return {
+      additionalContext: appendModelContextGuidance(additionalContext),
+      // A malformed receipt is presentation-only and must not suppress model
+      // context. The renderer also fails open independently.
+      receipt: receiptItems === null ? null : renderHookContextReceipt(receiptItems, request.nowMs)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/pi/extension.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 500;
+var DEFAULT_SHUTDOWN_FLUSH_TIMEOUT_MS = 5e3;
+var PI_CONTEXT_RECEIPT_ENTRY_TYPE = "fml-context-receipt";
+var PI_CONTEXT_STATE_ENTRY_TYPE = "fml-context-state";
+var pendingPosts = /* @__PURE__ */ new Set();
+function positiveInteger(value, fallback) {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function absoluteEnvPath(value) {
+  if (!value?.trim()) return void 0;
+  const trimmed = value.trim();
+  if (trimmed === "~") return os2.homedir();
+  if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) {
+    return path7.join(os2.homedir(), trimmed.slice(2));
+  }
+  return path7.isAbsolute(trimmed) ? path7.normalize(trimmed) : void 0;
+}
+function observerDirectory() {
+  const fmlHome = absoluteEnvPath(process.env.FML_HOME);
+  return absoluteEnvPath(process.env.FML_OBSERVER_DIR) ?? absoluteEnvPath(process.env.PANOPTICON_HOME) ?? (fmlHome ? path7.join(fmlHome, "panopticon") : path7.join(os2.homedir(), ".fml", "panopticon"));
+}
+function readObserverEndpoint(filePath) {
+  try {
+    const parsed = JSON.parse(fs4.readFileSync(filePath, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const record = parsed;
+    if (record.host !== "127.0.0.1" && record.host !== "::1" && record.host !== "localhost" || typeof record.port !== "number" || !Number.isInteger(record.port) || record.port <= 0 || record.port > 65535) {
+      return null;
+    }
+    return { host: record.host, port: record.port };
+  } catch {
+    return null;
+  }
+}
+function readObserverAuthToken(filePath) {
+  try {
+    return fs4.readFileSync(filePath, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function deliver(event) {
+  const directory = observerDirectory();
+  const endpoint = readObserverEndpoint(path7.join(directory, "endpoint.json"));
+  const authToken = readObserverAuthToken(path7.join(directory, "auth-token"));
+  if (!endpoint || !authToken) return;
+  const host = endpoint.host === "::1" ? "[::1]" : endpoint.host;
+  try {
+    const response = await fetch(`http://${host}:${endpoint.port}/hooks`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${authToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        target: "pi",
+        payload: event,
+        ...event.cwd ? { cwd: event.cwd } : {}
+      }),
+      signal: AbortSignal.timeout(
+        positiveInteger(
+          process.env.FML_PI_REQUEST_TIMEOUT_MS,
+          DEFAULT_REQUEST_TIMEOUT_MS
+        )
+      )
+    });
+    await response.arrayBuffer();
+  } catch {
+  }
+}
+function post(event) {
+  const request = deliver(event);
+  pendingPosts.add(request);
+  void request.finally(() => pendingPosts.delete(request));
+}
+async function flushPendingPosts(timeoutMs = positiveInteger(
+  process.env.FML_PI_SHUTDOWN_FLUSH_TIMEOUT_MS,
+  DEFAULT_SHUTDOWN_FLUSH_TIMEOUT_MS
+)) {
+  if (pendingPosts.size === 0) return;
+  await Promise.race([
+    Promise.allSettled([...pendingPosts]),
+    new Promise((resolve) => setTimeout(resolve, timeoutMs))
+  ]);
+}
+function modelLabel(model) {
+  if (!model || typeof model !== "object") return void 0;
+  const record = model;
+  const id = record.id ?? record.name ?? record.model;
+  const provider = record.provider ?? record.providerId;
+  return [provider, id].filter((value) => typeof value === "string" && value.length > 0).join(":") || void 0;
+}
+function isPiContextReceiptEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  return typeof entry.sessionId === "string" && typeof entry.injectionId === "string" && typeof entry.receipt === "string";
+}
+function isPiContextStateEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  if (typeof entry.sessionId !== "string") return false;
+  if (entry.kind === "session-start") return true;
+  if (entry.kind === "prompt") {
+    return typeof entry.count === "number" && Number.isSafeInteger(entry.count);
+  }
+  if (entry.kind === "file") return typeof entry.filePath === "string";
+  return entry.kind === "file-pending" && typeof entry.filePath === "string" && (entry.fileOperation === "read" || entry.fileOperation === "edit") && typeof entry.injectionId === "string" && typeof entry.nowMs === "number" && Number.isSafeInteger(entry.nowMs);
+}
+var RECEIPT_GRAPHEME_SEGMENTER = new Intl.Segmenter(void 0, {
+  granularity: "grapheme"
+});
+function wrapReceiptLine(text, width) {
+  if (width < 1) return [""];
+  let remaining = text.trim();
+  if (!remaining) return [""];
+  const lines = [];
+  while (remaining) {
+    let line = "";
+    let lineWidth = 0;
+    let end = 0;
+    let whitespaceEnd = 0;
+    for (const { segment, index } of RECEIPT_GRAPHEME_SEGMENTER.segment(
+      remaining
+    )) {
+      const segmentWidth = receiptDisplayWidth(segment);
+      if (segmentWidth > width) {
+        if (line) break;
+        line = "?";
+        end = index + segment.length;
+        break;
+      }
+      if (lineWidth + segmentWidth > width) break;
+      line += segment;
+      lineWidth += segmentWidth;
+      end = index + segment.length;
+      if (/^\s$/u.test(segment)) whitespaceEnd = end;
+    }
+    if (end === remaining.length) {
+      lines.push(line.trimEnd());
+      break;
+    }
+    if (whitespaceEnd > 0) {
+      lines.push(remaining.slice(0, whitespaceEnd).trimEnd());
+      remaining = remaining.slice(whitespaceEnd).trimStart();
+    } else {
+      lines.push(line);
+      remaining = remaining.slice(end);
+    }
+  }
+  return lines;
+}
+var PiReceiptComponent = class {
+  constructor(receipt) {
+    this.receipt = receipt;
+  }
+  invalidate() {
+  }
+  render(width) {
+    if (width < 1) return [""];
+    const lines = [];
+    for (const sourceLine of this.receipt.replace(/^\n/u, "").split("\n")) {
+      if (!sourceLine.startsWith("\u2502")) {
+        lines.push(...wrapReceiptLine(sourceLine, width));
+        continue;
+      }
+      const sourceContent = sourceLine.slice(1);
+      const sourceIsContinuation = sourceContent.startsWith("   ");
+      const firstPrefix = width === 1 ? "\u2502" : sourceIsContinuation ? "\u2502   " : "\u2502 ";
+      const continuationPrefix = width === 1 ? "\u2502" : "\u2502   ";
+      const content = sourceContent.trimStart();
+      const contentWidth = width - receiptDisplayWidth(continuationPrefix);
+      if (contentWidth < 1) {
+        lines.push(firstPrefix.slice(0, width));
+        continue;
+      }
+      const wrappedLines = wrapReceiptLine(content, contentWidth);
+      wrappedLines.forEach((wrapped, index) => {
+        lines.push(
+          `${index === 0 ? firstPrefix : continuationPrefix}${wrapped}`
+        );
+      });
+    }
+    return lines;
+  }
+};
+function fmlPiExtension(pi) {
+  let sessionId = randomUUID3();
+  let initializedSessionId = null;
+  let cwd;
+  let repository = null;
+  let promptCount = 0;
+  let sessionStartInjected = false;
+  let interactive = false;
+  const emittedFilePaths = /* @__PURE__ */ new Set();
+  const pendingFilePaths = /* @__PURE__ */ new Set();
+  const receiptInjectionIds = /* @__PURE__ */ new Set();
+  const requestTimes = /* @__PURE__ */ new Map();
+  const recordedPendingFileIds = /* @__PURE__ */ new Set();
+  const sessionStartsInFlight = /* @__PURE__ */ new Set();
+  pi.registerEntryRenderer(
+    PI_CONTEXT_RECEIPT_ENTRY_TYPE,
+    (entry) => new PiReceiptComponent(
+      isPiContextReceiptEntry(entry.data) ? entry.data.receipt : ""
+    )
+  );
+  function appendState(entry) {
+    try {
+      pi.appendEntry(PI_CONTEXT_STATE_ENTRY_TYPE, entry);
+    } catch {
+    }
+  }
+  function showReceipt(injectionId, injection) {
+    if (!interactive || !injection.receipt || receiptInjectionIds.has(injectionId)) {
+      return;
+    }
+    try {
+      pi.appendEntry(PI_CONTEXT_RECEIPT_ENTRY_TYPE, {
+        sessionId,
+        injectionId,
+        receipt: injection.receipt
+      });
+      receiptInjectionIds.add(injectionId);
+    } catch {
+    }
+  }
+  async function injectContext(event, injectionId, deliverContext) {
+    try {
+      if (!repository) return "unavailable";
+      const destination = getActiveHookDestinationBinding();
+      if (!destination) return "unavailable";
+      const nowMs = requestTimes.get(injectionId) ?? Date.now();
+      requestTimes.set(injectionId, nowMs);
+      const injection = await requestServerHookContextInjection(
+        {
+          ...event,
+          repository,
+          sessionId,
+          target: "pi",
+          injectionId,
+          nowMs
+        },
+        destination
+      );
+      if (injection === null) return "unavailable";
+      if (injection.additionalContext === null) {
+        requestTimes.delete(injectionId);
+        return "empty";
+      }
+      await deliverContext(injection.additionalContext);
+      requestTimes.delete(injectionId);
+      showReceipt(injectionId, injection);
+      return "injected";
+    } catch {
+      return "unavailable";
+    }
+  }
+  function resetAndRestore(entries) {
+    repository = null;
+    promptCount = 0;
+    sessionStartInjected = false;
+    emittedFilePaths.clear();
+    pendingFilePaths.clear();
+    receiptInjectionIds.clear();
+    requestTimes.clear();
+    recordedPendingFileIds.clear();
+    for (const entry of entries) {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+      const record = entry;
+      if (record.type !== "custom") continue;
+      if (record.customType === PI_CONTEXT_RECEIPT_ENTRY_TYPE) {
+        if (isPiContextReceiptEntry(record.data) && record.data.sessionId === sessionId) {
+          receiptInjectionIds.add(record.data.injectionId);
+        }
+        continue;
+      }
+      if (record.customType !== PI_CONTEXT_STATE_ENTRY_TYPE || !isPiContextStateEntry(record.data) || record.data.sessionId !== sessionId) {
+        continue;
+      }
+      const state = record.data;
+      if (state.kind === "session-start") sessionStartInjected = true;
+      if (state.kind === "prompt")
+        promptCount = Math.max(promptCount, state.count);
+      if (state.kind === "file") emittedFilePaths.add(state.filePath);
+      if (state.kind === "file-pending") {
+        requestTimes.set(state.injectionId, state.nowMs);
+        recordedPendingFileIds.add(state.injectionId);
+      }
+    }
+  }
+  function emit(event) {
+    post({ ...event, session_id: sessionId, source: "pi", cwd });
+  }
+  pi.on("session_start", async (event, context) => {
+    const nextSessionId = context.sessionManager.getSessionId();
+    sessionId = nextSessionId;
+    cwd = context.cwd;
+    interactive = context.mode === "tui";
+    if (initializedSessionId !== sessionId) {
+      initializedSessionId = sessionId;
+      resetAndRestore(context.sessionManager.getEntries());
+    }
+    emit({ hook_event_name: "SessionStart" });
+    try {
+      repository = cwd ? resolveRepositorySlugFromCwd(cwd, 250) : null;
+      if (!repository) return;
+    } catch {
+      return;
+    }
+    if (event.reason === "reload" || event.reason === "resume") return;
+    if (sessionStartInjected || sessionStartsInFlight.has(sessionId)) return;
+    sessionStartsInFlight.add(sessionId);
+    try {
+      const injectionId = hookContextInjectionId("pi", `${sessionId}:start`);
+      const outcome = await injectContext(
+        { eventType: "SessionStart" },
+        injectionId,
+        async (additionalContext) => {
+          pi.sendMessage({
+            customType: "fml-context",
+            content: additionalContext,
+            display: false
+          });
+        }
+      );
+      if (outcome === "injected") {
+        sessionStartInjected = true;
+        appendState({ sessionId, kind: "session-start" });
+      }
+    } catch {
+    } finally {
+      sessionStartsInFlight.delete(nextSessionId);
+    }
+  });
+  pi.on("input", async (event) => {
+    emit({ hook_event_name: "UserPromptSubmit", prompt: event.text });
+  });
+  pi.on("before_agent_start", async (event) => {
+    const promptIndex = promptCount;
+    promptCount += 1;
+    appendState({ sessionId, kind: "prompt", count: promptCount });
+    if (promptIndex === 0) return;
+    await injectContext(
+      {
+        eventType: "UserPromptSubmit",
+        prompt: event.prompt.slice(0, 2e4)
+      },
+      hookContextInjectionId("pi", `${sessionId}:prompt:${promptIndex}`),
+      async (additionalContext) => {
+        pi.sendMessage({
+          customType: "fml-context",
+          content: additionalContext,
+          display: false
+        });
+      }
+    );
+  });
+  pi.on("turn_start", async (event) => {
+    emit({
+      hook_event_name: "TurnStart",
+      turn_index: event.turnIndex,
+      pi_timestamp: event.timestamp
     });
   });
   pi.on("turn_end", async (event) => {
@@ -284,6 +2900,66 @@ function fmlPiExtension(pi) {
       tool_call_id: event.toolCallId,
       tool_input: event.input
     });
+    try {
+      const trigger = extractHookContextFileTrigger(
+        event.toolName,
+        event.input
+      );
+      if (!trigger || !cwd || !repository) return;
+      const root = resolveRepositoryRootFromCwd(cwd, 250);
+      const filePath = canonicalHookContextFilePath(
+        trigger.filePath,
+        cwd,
+        root
+      );
+      if (emittedFilePaths.has(filePath) || pendingFilePaths.has(filePath))
+        return;
+      pendingFilePaths.add(filePath);
+      try {
+        const injectionId = hookContextInjectionId(
+          "pi",
+          `${sessionId}:file:${trigger.fileOperation}:${filePath}`
+        );
+        const nowMs = requestTimes.get(injectionId) ?? Date.now();
+        requestTimes.set(injectionId, nowMs);
+        if (!recordedPendingFileIds.has(injectionId)) {
+          appendState({
+            sessionId,
+            kind: "file-pending",
+            filePath,
+            fileOperation: trigger.fileOperation,
+            injectionId,
+            nowMs
+          });
+          recordedPendingFileIds.add(injectionId);
+        }
+        const outcome = await injectContext(
+          {
+            eventType: "PreToolUse",
+            filePath,
+            fileOperation: trigger.fileOperation
+          },
+          injectionId,
+          async (additionalContext) => {
+            pi.sendMessage(
+              {
+                customType: "fml-context",
+                content: additionalContext,
+                display: false
+              },
+              { deliverAs: "steer" }
+            );
+          }
+        );
+        if (outcome === "empty" || outcome === "injected") {
+          emittedFilePaths.add(filePath);
+          appendState({ sessionId, kind: "file", filePath });
+        }
+      } finally {
+        pendingFilePaths.delete(filePath);
+      }
+    } catch {
+    }
   });
   pi.on("tool_result", async (event) => {
     emit({