@gatherthread/dsh-host 0.1.0-alpha.8 → 0.1.0-beta.1

package/dist/bundle/native-plugin.js

@@ -823,10 +823,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path10) {
-  if (!path10)
+function getElementAtPath(obj, path11) {
+  if (!path11)
     return obj;
-  return path10.reduce((acc, key) => acc?.[key], obj);
+  return path11.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1166,11 +1166,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path10, issues) {
+function prefixIssues(path11, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path10);
+    iss.path.unshift(path11);
     return iss;
   });
 }
@@ -1277,16 +1277,16 @@ function cleanEnum(obj) {
 }
 function base64ToUint8Array(base643) {
   const binaryString = atob(base643);
-  const bytes = new Uint8Array(binaryString.length);
+  const bytes2 = new Uint8Array(binaryString.length);
   for (let i = 0; i < binaryString.length; i++) {
-    bytes[i] = binaryString.charCodeAt(i);
+    bytes2[i] = binaryString.charCodeAt(i);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToBase64(bytes) {
+function uint8ArrayToBase64(bytes2) {
   let binaryString = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binaryString += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.length; i++) {
+    binaryString += String.fromCharCode(bytes2[i]);
   }
   return btoa(binaryString);
 }
@@ -1295,22 +1295,22 @@ function base64urlToUint8Array(base64url3) {
   const padding = "=".repeat((4 - base643.length % 4) % 4);
   return base64ToUint8Array(base643 + padding);
 }
-function uint8ArrayToBase64url(bytes) {
-  return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function uint8ArrayToBase64url(bytes2) {
+  return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function hexToUint8Array(hex3) {
   const cleanHex = hex3.replace(/^0x/, "");
   if (cleanHex.length % 2 !== 0) {
     throw new Error("Invalid hex string length");
   }
-  const bytes = new Uint8Array(cleanHex.length / 2);
+  const bytes2 = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+    bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+function uint8ArrayToHex(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 var Class = class {
   constructor(..._args) {
@@ -1620,16 +1620,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path10 = []) => {
+  const processError = (error63, path11 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else {
-        const fullpath = [...path10, ...issue2.path];
+        const fullpath = [...path11, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1668,17 +1668,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path10 = []) => {
+  const processError = (error63, path11 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else {
-        const fullpath = [...path10, ...issue2.path];
+        const fullpath = [...path11, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1717,8 +1717,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path10 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path10) {
+  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path11) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18820,13 +18820,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path10 = ref.slice(1).split("/").filter(Boolean);
-  if (path10.length === 0) {
+  const path11 = ref.slice(1).split("/").filter(Boolean);
+  if (path11.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path10[0] === defsKey) {
-    const key = path10[1] === void 0 ? void 0 : decodeJSONPointerSegment(path10[1]);
+  if (path11[0] === defsKey) {
+    const key = path11[1] === void 0 ? void 0 : decodeJSONPointerSegment(path11[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19685,16 +19685,16 @@ var Commit = external_exports.string().regex(/^[a-f0-9]{40}$/);
 var BranchId = external_exports.string().regex(/^branch-[a-f0-9]{24}$/);
 var pathEncoder = new TextEncoder();
 var hfsIgnoredCharacters = /[\u200c-\u200f\u202a-\u202e\u206a-\u206f\ufeff]/gu;
-function portablePathKey(path10) {
-  return path10.normalize("NFC").replace(hfsIgnoredCharacters, "").toLowerCase();
+function portablePathKey(path11) {
+  return path11.normalize("NFC").replace(hfsIgnoredCharacters, "").toLowerCase();
 }
 function containsCodeSyncSecret(text) {
-  return /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----|\b(?:gh[pousr]|github_pat|glpat|sk|xox[baprs])[-_][A-Za-z0-9_-]{16,}|\b(?:gt[abidp]|acp(?:i|d)?)_[A-Za-z0-9_-]{20,}|\bAKIA[A-Z0-9]{16}\b/u.test(text);
+  return /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----|\b(?:gh[pousr]|github_pat|glpat|sk|xox[baprs])[-_][A-Za-z0-9_-]{16,}|\b(?:(?:gt[abidp]|gteg?)|acp(?:i|d)?)_[A-Za-z0-9_-]{20,}|\bAKIA[A-Z0-9]{16}\b/u.test(text);
 }
-function isCodeSyncPathAllowed(path10) {
-  if (!path10 || path10.length > 500 || path10.startsWith("/") || /[\\\u0000-\u001f\u007f\ud800-\udfff:<>"|?*]/u.test(path10))
+function isCodeSyncPathAllowed(path11) {
+  if (!path11 || path11.length > 500 || path11.startsWith("/") || /[\\\u0000-\u001f\u007f\ud800-\udfff:<>"|?*]/u.test(path11))
     return false;
-  const components = path10.split("/");
+  const components = path11.split("/");
   return components.every((part) => {
     const lower = portablePathKey(part);
     if (!part || pathEncoder.encode(part).byteLength > 255 || part === "." || part === ".." || part.endsWith(".") || part.endsWith(" "))
@@ -19714,34 +19714,42 @@ function isCodeSyncPathAllowed(path10) {
     return !/\.(?:pem|p12|pfx|key)$/iu.test(lower) && !/^(?:id_rsa|id_ed25519)(?:\.|$)/iu.test(lower);
   });
 }
-var CodeFileSchema = external_exports.object({
-  path: external_exports.string().refine(isCodeSyncPathAllowed, "Unsafe or private code path"),
-  content_base64: external_exports.string().max(4 * Math.ceil(CODE_SYNC_MAX_FILE_BYTES / 3)).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/),
-  executable: external_exports.boolean()
-}).strict();
-var CodeFilesSchema = external_exports.array(CodeFileSchema).max(CODE_SYNC_MAX_FILES).superRefine((files, context) => {
-  let size = 0;
-  const names = /* @__PURE__ */ new Set();
-  for (const [index, file2] of files.entries()) {
-    const bytes = file2.content_base64.length * 3 / 4 - (file2.content_base64.endsWith("==") ? 2 : file2.content_base64.endsWith("=") ? 1 : 0);
-    size += bytes;
-    const normalized = portablePathKey(file2.path);
-    if (bytes > CODE_SYNC_MAX_FILE_BYTES || names.has(normalized))
-      context.addIssue({ code: "custom", path: [index], message: "File limit or duplicate portable path" });
-    names.add(normalized);
-  }
-  if (size > CODE_SYNC_MAX_SNAPSHOT_BYTES)
-    context.addIssue({ code: "custom", message: "Code snapshot exceeds 8 MiB" });
-  for (const name2 of names) {
-    const parts = name2.split("/");
-    parts.pop();
-    while (parts.length) {
-      if (names.has(parts.join("/")))
-        context.addIssue({ code: "custom", message: "File and directory paths overlap" });
+var CLOUD_CODE_SYNC_LIMITS = { maxFiles: CODE_SYNC_MAX_FILES, maxFileBytes: CODE_SYNC_MAX_FILE_BYTES, maxSnapshotBytes: CODE_SYNC_MAX_SNAPSHOT_BYTES };
+var GITHUB_CODE_SYNC_LIMITS = { maxFiles: 1e4, maxFileBytes: 20 * 1024 * 1024, maxSnapshotBytes: 128 * 1024 * 1024 };
+function createCodeFileSchema(limits) {
+  return external_exports.object({
+    path: external_exports.string().refine(isCodeSyncPathAllowed, "Unsafe or private code path"),
+    content_base64: external_exports.string().max(4 * Math.ceil(limits.maxFileBytes / 3)).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/),
+    executable: external_exports.boolean()
+  }).strict();
+}
+var CodeFileSchema = createCodeFileSchema(CLOUD_CODE_SYNC_LIMITS);
+function createCodeFilesSchema(limits) {
+  return external_exports.array(createCodeFileSchema(limits)).max(limits.maxFiles).superRefine((files, context) => {
+    let size = 0;
+    const names = /* @__PURE__ */ new Set();
+    for (const [index, file2] of files.entries()) {
+      const bytes2 = file2.content_base64.length * 3 / 4 - (file2.content_base64.endsWith("==") ? 2 : file2.content_base64.endsWith("=") ? 1 : 0);
+      size += bytes2;
+      const normalized = portablePathKey(file2.path);
+      if (bytes2 > limits.maxFileBytes || names.has(normalized))
+        context.addIssue({ code: "custom", path: [index], message: "File limit or duplicate portable path" });
+      names.add(normalized);
+    }
+    if (size > limits.maxSnapshotBytes)
+      context.addIssue({ code: "custom", message: "Code snapshot exceeds provider limit" });
+    for (const name2 of names) {
+      const parts = name2.split("/");
       parts.pop();
+      while (parts.length) {
+        if (names.has(parts.join("/")))
+          context.addIssue({ code: "custom", message: "File and directory paths overlap" });
+        parts.pop();
+      }
     }
-  }
-});
+  });
+}
+var CodeFilesSchema = createCodeFilesSchema(CLOUD_CODE_SYNC_LIMITS);
 var CodeEnableInputSchema = external_exports.object({ idempotency_key: Key }).strict();
 var CodeDisableInputSchema = external_exports.object({ idempotency_key: Key }).strict();
 var CodeCheckpointInputSchema = external_exports.object({
@@ -19803,6 +19811,47 @@ var CodeSnapshotResultSchema = external_exports.object({ snapshot: external_expo
 }).strict() }).strict();
 var codeSyncRequestKinds = ["code_sync_status", "code_upload", "code_download", "code_recover", "code_auto_upload_enable", "code_auto_upload_disable"];
 
+// ../protocol/dist/src/github-sync.js
+var GitHubRepositorySchema = external_exports.string().max(140).regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9_.-]{1,100}$/).refine((value) => {
+  const repository = value.split("/")[1];
+  return repository !== "." && repository !== ".." && !repository.toLowerCase().endsWith(".git");
+}, "Use owner/repository without a .git suffix");
+function isGitHubBranchAllowed(value) {
+  return value.length > 0 && value.length <= 200 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value) && !value.includes("..") && value.split("/").every((part) => !!part && !part.startsWith(".") && !part.endsWith(".") && !part.toLowerCase().endsWith(".lock")) && value !== "HEAD";
+}
+var GitHubBranchSchema = external_exports.string().refine(isGitHubBranchAllowed, "Unsafe GitHub branch name");
+var GitHubBaseBranchSchema = GitHubBranchSchema.refine((value) => !value.startsWith("gatherthread/"), "The shared base cannot use the GatherThread personal branch namespace");
+var GitHubPersonalBranchSchema = external_exports.string().regex(/^gatherthread\/[a-f0-9]{24}\/[a-f0-9]{24}$/);
+var GitHubConnectionSchema = external_exports.object({
+  repository: GitHubRepositorySchema,
+  base_branch: GitHubBaseBranchSchema,
+  enabled: external_exports.boolean(),
+  revision: external_exports.string().uuid()
+}).strict();
+var GitHubProjectStatusSchema = external_exports.object({
+  connection: GitHubConnectionSchema.nullable(),
+  branch: GitHubPersonalBranchSchema,
+  can_configure: external_exports.boolean(),
+  // GatherThread membership only. GitHub permissions must be checked locally.
+  can_write: external_exports.boolean()
+}).strict();
+var GitHubConnectionInputSchema = external_exports.object({
+  repository: GitHubRepositorySchema,
+  base_branch: GitHubBaseBranchSchema,
+  enabled: external_exports.boolean(),
+  expected_revision: external_exports.string().uuid().nullable()
+}).strict();
+var githubCodeSyncRequestKinds = [
+  "github_auth_connect",
+  "github_code_sync_status",
+  "github_code_upload",
+  "github_code_download",
+  "github_code_recover",
+  "github_code_auto_upload_enable",
+  "github_code_auto_upload_disable",
+  "github_code_update"
+];
+
 // ../protocol/dist/src/history-summary.js
 var HISTORY_SUMMARY_MAX_SOURCE_BYTES = 20 * 1024;
 var HISTORY_SUMMARY_MAX_PROMPT_BYTES = 30 * 1024;
@@ -19827,6 +19876,155 @@ function historySummaryMarker(event) {
   return { version: 1, source_event_ids: ids, source_digest: marker.source_digest };
 }
 
+// ../protocol/dist/src/test-gate.js
+var TestGateExchangeInputSchema = external_exports.object({
+  admission_code: external_exports.string().regex(/^gte_[A-Za-z0-9_-]{43}$/)
+}).strict();
+var TestGateStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  admitted: external_exports.boolean(),
+  environment: external_exports.enum(["production", "test"])
+}).strict();
+
+// ../protocol/dist/src/hosted-github.js
+var Key2 = external_exports.string().min(8).max(200);
+var HostedGithubRepositoryInputSchema = external_exports.object({
+  repository: external_exports.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u).max(140),
+  base_branch: external_exports.string().min(1).max(200).refine((v) => !/[\s~^:?*\[\\]/u.test(v) && !v.includes("..") && !v.startsWith("-") && !v.endsWith("/") && !v.endsWith(".lock"))
+}).strict();
+var HostedGithubTaskInputSchema = external_exports.object({
+  content: external_exports.string().trim().min(1).max(6e3),
+  profile_id: external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/u),
+  idempotency_key: Key2,
+  continue_task_id: external_exports.string().regex(/^gh-task-[a-f0-9]{32}$/u).optional(),
+  reply_to_event_id: external_exports.string().min(1).max(128).nullable().optional()
+}).strict();
+var HostedGithubCompleteInputSchema = external_exports.object({
+  state: external_exports.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  code: external_exports.string().min(1).max(500)
+}).strict();
+var HostedGithubPrInputSchema = external_exports.object({
+  title: external_exports.string().trim().min(1).max(200),
+  body: external_exports.string().max(6e3),
+  expected_revision: external_exports.string().regex(/^[a-f0-9]{64}$/u)
+}).strict();
+var Login = external_exports.string().regex(/^[A-Za-z0-9-]{1,39}$/u);
+var TaskId = external_exports.string().regex(/^gh-task-[a-f0-9]{32}$/u);
+var Sha = external_exports.string().regex(/^[a-f0-9]{40}$/u).nullable();
+var Revision = external_exports.string().regex(/^[a-f0-9]{64}$/u).nullable();
+var PullUrl = external_exports.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/u).nullable();
+var HostedGithubBindingSchema = HostedGithubRepositoryInputSchema;
+var HostedGithubStatusSchema = external_exports.union([
+  external_exports.object({ enabled: external_exports.literal(false) }).strict(),
+  external_exports.object({
+    enabled: external_exports.literal(true),
+    connected: external_exports.boolean(),
+    login: Login.nullable(),
+    binding: HostedGithubBindingSchema.nullable(),
+    installation_url: external_exports.string().max(2048).regex(/^https:\/\/github\.com\/apps\/[A-Za-z0-9_.-]+\/installations\/new$/u)
+  }).strict().refine((v) => v.connected ? v.login !== null : v.login === null && v.binding === null)
+]);
+var HostedGithubAuthorizationSchema = external_exports.object({ authorization_url: external_exports.string().max(4096).refine((value) => {
+  try {
+    const url2 = new URL(value);
+    return url2.origin === "https://github.com" && url2.pathname === "/login/oauth/authorize" && !url2.username && !url2.password && !url2.hash && /^[A-Za-z0-9_-]{43}$/u.test(url2.searchParams.get("state") ?? "") && [...url2.searchParams.keys()].every((key) => ["client_id", "redirect_uri", "state", "code_challenge", "code_challenge_method", "prompt"].includes(key));
+  } catch {
+    return false;
+  }
+}) }).strict();
+var HostedGithubConnectionSchema = external_exports.object({ connected: external_exports.literal(true), login: Login }).strict();
+var HostedGithubDisconnectionSchema = external_exports.object({ connected: external_exports.literal(false) }).strict();
+var HostedGithubTaskSummarySchema = external_exports.object({
+  id: TaskId,
+  session_id: external_exports.string().min(1).max(128),
+  profile_id: HostedGithubTaskInputSchema.shape.profile_id,
+  resumable: external_exports.boolean(),
+  state: external_exports.enum(["running", "completed", "failed", "interrupted"]),
+  repository: HostedGithubRepositoryInputSchema.shape.repository,
+  base_branch: HostedGithubRepositoryInputSchema.shape.base_branch,
+  base_sha: Sha,
+  revision: Revision,
+  error_code: external_exports.string().regex(/^[a-z][a-z0-9_]{0,63}$/u).nullable(),
+  pull_request_url: PullUrl,
+  expires_at: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+}).strict();
+var bytes = (value) => value.length / 4 * 3 - (value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0);
+var Source = external_exports.string().max(2796204).regex(/^[A-Za-z0-9+/]*={0,2}$/u).refine((value) => value.length % 4 === 0 && bytes(value) <= 2 * 1024 * 1024).nullable();
+var HostedGithubChangeSchema = external_exports.object({
+  path: external_exports.string().max(4096).refine(isCodeSyncPathAllowed),
+  before_base64: Source,
+  after_base64: Source,
+  before_executable: external_exports.boolean().nullable(),
+  after_executable: external_exports.boolean().nullable()
+}).strict().refine((v) => v.before_base64 === null === (v.before_executable === null) && v.after_base64 === null === (v.after_executable === null) && (v.before_base64 !== null || v.after_base64 !== null));
+var HostedGithubTaskSchema = HostedGithubTaskSummarySchema.extend({
+  answer: external_exports.string().max(14e3).nullable(),
+  changes: external_exports.array(HostedGithubChangeSchema).max(2e3)
+}).strict().refine((v) => {
+  if (new Set(v.changes.map((c) => c.path)).size !== v.changes.length)
+    return false;
+  for (const side of ["before_base64", "after_base64"]) {
+    const values = v.changes.map((c) => c[side]).filter((s) => s !== null);
+    if (values.length > 1e3 || values.reduce((sum, s) => sum + bytes(s), 0) > 8 * 1024 * 1024)
+      return false;
+  }
+  return !v.resumable || v.state !== "running" && v.pull_request_url === null;
+});
+var HostedGithubTaskListSchema = external_exports.object({ tasks: external_exports.array(HostedGithubTaskSummarySchema).max(10) }).strict();
+
+// ../protocol/dist/src/registration.js
+var RegistrationEmailSchema = external_exports.string().max(254).trim().toLowerCase().regex(/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/).refine((value) => value.split("@")[0].length <= 64 && value.split("@")[1].split(".").every((part) => part.length <= 63));
+var Label = external_exports.string().regex(/^[^\u0000-\u001f\u007f-\u009f]*$/u).trim().min(1).max(120);
+var SendRegistrationInputSchema = external_exports.object({
+  email: RegistrationEmailSchema,
+  challenge_token: external_exports.string().min(1).max(2048),
+  idempotency_key: external_exports.string().uuid(),
+  locale: external_exports.enum(["en", "zh-CN"])
+}).strict();
+var AccountPasswordSchema = external_exports.string().min(12).max(128).refine((value) => new TextEncoder().encode(value).byteLength <= 512);
+var EmailLoginInputSchema = external_exports.object({
+  email: RegistrationEmailSchema,
+  password: AccountPasswordSchema,
+  device_name: Label,
+  remember_device: external_exports.boolean().default(false)
+}).strict();
+var VerifyRegistrationInputSchema = external_exports.object({
+  registration_id: external_exports.string().uuid(),
+  code: external_exports.string().regex(/^\d{8}$/),
+  display_name: Label,
+  device_name: Label,
+  remember_device: external_exports.boolean().default(false),
+  privacy_acknowledged: external_exports.literal(true),
+  password: AccountPasswordSchema
+}).strict();
+var RegistrationStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  site_key: external_exports.string().nullable(),
+  challenge_binding: external_exports.string().nullable()
+}).strict();
+var RegistrationSentSchema = external_exports.object({
+  registration_id: external_exports.string().uuid(),
+  expires_in_seconds: external_exports.literal(600),
+  resend_after_seconds: external_exports.literal(60)
+}).strict();
+var PasswordResetSentSchema = external_exports.object({
+  reset_id: external_exports.string().uuid(),
+  expires_in_seconds: external_exports.literal(600),
+  resend_after_seconds: external_exports.literal(60)
+}).strict();
+var VerifyPasswordResetInputSchema = external_exports.object({
+  reset_id: external_exports.string().uuid(),
+  email: RegistrationEmailSchema,
+  code: external_exports.string().regex(/^\d{8}$/),
+  password: AccountPasswordSchema,
+  password_confirmation: AccountPasswordSchema,
+  locale: external_exports.enum(["en", "zh-CN"])
+}).strict().refine((value) => value.password === value.password_confirmation);
+var EmailAccountSessionSchema = external_exports.object({
+  actor: external_exports.object({ user_id: external_exports.string(), display_name: external_exports.string(), device_id: external_exports.string(), can_create_projects: external_exports.literal(true) }).strict(),
+  expires_at: external_exports.string().datetime()
+}).strict();
+
 // ../protocol/dist/src/index.js
 var sessionModes = ["solo", "multi"];
 var membershipRoles = ["owner", "participant", "viewer"];
@@ -19971,6 +20169,43 @@ var AppendEventInputSchema = external_exports.object({
   observed_model: external_exports.string().trim().min(1).max(160).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional(),
   observed_reasoning_effort: external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f-\u009f]+$/u).optional()
 });
+var HostedAgentRequestInputSchema = external_exports.object({
+  profile_id: external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/u).default("default"),
+  content: external_exports.string().trim().min(1).max(6e3),
+  include_code: external_exports.boolean().default(false),
+  idempotency_key: IdempotencyKeySchema,
+  reply_to_event_id: IdSchema.nullable().optional(),
+  github_task_id: external_exports.string().regex(/^gh-task-[a-f0-9]{32}$/u).optional()
+}).strict();
+var HostedAgentStatusSchema = external_exports.discriminatedUnion("enabled", [
+  external_exports.object({ enabled: external_exports.literal(false) }).strict(),
+  external_exports.object({
+    enabled: external_exports.literal(true),
+    harness: external_exports.literal("opencode"),
+    utc_day: external_exports.string(),
+    user_limit_runs: external_exports.number().int().nonnegative().nullable(),
+    user_used_runs: external_exports.number().int().nonnegative(),
+    global_limit_runs: external_exports.number().int().nonnegative().nullable(),
+    global_used_runs: external_exports.number().int().nonnegative(),
+    rate_limits: external_exports.object({
+      user_min_interval_seconds: external_exports.number().int().min(1).max(3600),
+      user_max_concurrent: external_exports.number().int().min(1).max(8),
+      user_active_runs: external_exports.number().int().nonnegative(),
+      retry_after_seconds: external_exports.number().int().nonnegative()
+    }).strict().optional(),
+    profiles: external_exports.array(external_exports.object({
+      id: external_exports.string(),
+      label: external_exports.string(),
+      provider: external_exports.string(),
+      model: external_exports.string(),
+      available: external_exports.boolean(),
+      capacity: external_exports.number().int().nonnegative(),
+      status: external_exports.enum(["available", "busy", "daily_limit", "cooldown", "user_busy", "rate_limit"])
+    }).strict()),
+    capabilities: external_exports.array(external_exports.string()),
+    privacy: external_exports.string()
+  }).strict()
+]);
 var SingleLineTitleSchema = external_exports.string().regex(/^[^\u0000-\u001f\u007f-\u009f]*$/u, "Title must not contain control characters").trim().min(1).max(200);
 var SessionTitleSchema = SingleLineTitleSchema;
 var ProjectTitleSchema = SingleLineTitleSchema;
@@ -20017,7 +20252,12 @@ var ProjectListItemSchema = ProjectRecordSchema.omit({ owner_user_id: true }).ex
   role: MembershipRoleSchema,
   session_count: external_exports.number().int().nonnegative()
 });
+var AvatarIdSchema = external_exports.enum(["cat", "fox", "bear", "rabbit", "penguin", "owl"]);
+var SetAccountAvatarInputSchema = external_exports.object({ avatar_id: AvatarIdSchema.nullable() }).strict();
+var AccountAvatarProfileSchema = external_exports.object({ user_id: IdSchema, avatar_id: AvatarIdSchema.nullable() });
+var SessionAvatarProfilesSchema = external_exports.object({ profiles: external_exports.array(AccountAvatarProfileSchema) });
 var ProjectMemberRecordSchema = external_exports.object({
+  avatar_id: AvatarIdSchema.nullable().optional(),
   user_id: IdSchema,
   display_name: external_exports.string().trim().min(1).max(120),
   role: MembershipRoleSchema
@@ -20232,6 +20472,7 @@ var snapshotRequestStatuses = ["pending", "claimed", "completed", "failed"];
 var SnapshotRequestStatusSchema = external_exports.enum(snapshotRequestStatuses);
 var snapshotRequestKinds = [
   ...codeSyncRequestKinds,
+  ...githubCodeSyncRequestKinds,
   "immutable",
   "visible_history_replace",
   "local_sync_status",
@@ -20553,9 +20794,9 @@ var HttpCollaborationClient = class {
     }));
     return fromWireSnapshotRequest(body.snapshot_request ?? body);
   }
-  async #request(path10, init = {}) {
+  async #request(path11, init = {}) {
     const signal = combineSignals(init.signal ?? void 0, this.#signal, AbortSignal.timeout(this.#requestTimeoutMs));
-    const response = await this.#fetch(`${this.#baseUrl}${path10}`, {
+    const response = await this.#fetch(`${this.#baseUrl}${path11}`, {
       ...init,
       redirect: "error",
       signal,
@@ -21228,10 +21469,14 @@ var ProjectCodeSync = class _ProjectCodeSync {
   #apiUrl;
   #root = "";
   #stateRoot = "";
+  #lockRoot = "";
   #initialized;
   #stableDigest = "";
   #stableSince = 0;
   #lastAutomaticAttempt = 0;
+  get #limits() {
+    return this.#options.storage?.limits ?? CLOUD_CODE_SYNC_LIMITS;
+  }
   constructor(options) {
     const url2 = new URL(options.apiUrl);
     if (url2.username || url2.password || url2.search || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) {
@@ -21265,6 +21510,9 @@ var ProjectCodeSync = class _ProjectCodeSync {
       this.#root = path2.join(await realpath(path2.dirname(requestedRoot)), path2.basename(requestedRoot));
     }
     this.#stateRoot = this.#options.stateRoot ?? path2.join(homedir2(), ".gatherthread", "code-sync", digest(this.#root));
+    const sharedRoot = this.#stateRoot;
+    if (this.#options.storage)
+      this.#stateRoot = path2.join(this.#stateRoot, digest(this.#options.storage.key));
     if (isWithin(this.#root, path2.resolve(this.#stateRoot)))
       throw new CodeSyncError("code_sync_binding", "Code sync state must stay outside source files.");
     await mkdir2(this.#stateRoot, { recursive: true, mode: 448 });
@@ -21274,6 +21522,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
     if (isWithin(this.#root, this.#stateRoot))
       throw new CodeSyncError("code_sync_binding", "Private code sync state resolves inside source files.");
     await chmod2(this.#stateRoot, 448);
+    this.#lockRoot = await realpath(sharedRoot);
     await this.#locked(async () => {
       const inventoryPath = path2.join(this.#stateRoot, "inventory.git");
       try {
@@ -21284,6 +21533,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
           throw error62;
       }
       await git(["init", "--bare", "--quiet", inventoryPath], this.#stateRoot);
+      await this.#options.storage?.initialize(this.#stateRoot);
       const filename = path2.join(this.#stateRoot, "binding.json");
       try {
         await this.#readBinding();
@@ -21297,7 +21547,9 @@ var ProjectCodeSync = class _ProjectCodeSync {
           actor_id: this.#options.actorId,
           workspace_path: this.#root,
           base_commit: null,
-          automatic_upload: false,
+          // GitHub authorization is an explicit local action. New GitHub
+          // bindings follow settled source edits automatically thereafter.
+          automatic_upload: this.#options.storage?.metadata.provider === "github",
           baseline: {}
         }));
       }
@@ -21348,7 +21600,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
         idempotency_key: `code-upload-${digest(JSON.stringify([this.#options.projectId, this.#options.actorId, uploadBase, inventory.hashes]))}`
       };
       await this.#requireWorkspace();
-      const parsed = CodeMutationResultSchema.safeParse(await this.#request("/checkpoints", body));
+      const parsed = CodeMutationResultSchema.safeParse(this.#options.storage ? await this.#options.storage.checkpoint(body) : await this.#request("/checkpoints", body));
       if (!parsed.success)
         throw invalidResponse();
       const verified = await this.#snapshot(parsed.data.status);
@@ -21389,7 +21641,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
           await this.#save(binding);
         },
         baselineExecutables: new Set(binding.executable_paths ?? [])
-      });
+      }, this.#limits);
       const verified = await this.#inventory(new Set(snapshot.files.filter((file2) => file2.executable).map((file2) => file2.path)));
       if (!sameHashes(verified.hashes, nextHashes))
         throw new CodeSyncError("code_sync_conflict", "Local files changed during download. Check the workspace before retrying.");
@@ -21430,11 +21682,25 @@ var ProjectCodeSync = class _ProjectCodeSync {
       const recoveryName = `${recoveryStem.join("")}-recovered-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/gu, "").slice(0, 14)}-${randomUUID().slice(0, 8)}`;
       const recoveryPath = path2.join(path2.dirname(this.#root), recoveryName);
       await mkdir2(recoveryPath, { mode: 448 });
-      await applySnapshot(recoveryPath, snapshot.files, {});
+      await applySnapshot(recoveryPath, snapshot.files, {}, void 0, this.#limits);
       const restored = new _ProjectCodeSync({
         ...this.#options,
         workspacePath: recoveryPath,
-        stateRoot: path2.join(path2.dirname(this.#stateRoot), digest(recoveryPath))
+        ...this.#options.stateRoot ? { stateRoot: path2.join(path2.dirname(this.#options.stateRoot), digest(recoveryPath)) } : {},
+        // The transport has private mutable Git state; recovery only seeds the
+        // baseline and does not need another transport initialization here.
+        ...this.#options.storage ? { storage: {
+          ...this.#options.storage,
+          key: this.#options.storage.key,
+          limits: this.#limits,
+          metadata: this.#options.storage.metadata,
+          initialize: async () => {
+          },
+          status: () => this.#cloudStatus(),
+          snapshot: (status) => this.#snapshot(status),
+          checkpoint: (input2) => this.#options.storage.checkpoint(input2),
+          update: () => this.#options.storage.update()
+        } } : {}
       });
       await restored.initialize();
       await restored.#locked(async () => {
@@ -21460,7 +21726,18 @@ var ProjectCodeSync = class _ProjectCodeSync {
     await this.initialize();
     return this.#locked(async () => {
       const binding = await this.#readBinding();
-      const cloud = await this.#cloudStatus();
+      if (!enabled) {
+        binding.automatic_upload = false;
+        await this.#save(binding);
+      }
+      let cloud;
+      try {
+        cloud = await this.#cloudStatus();
+      } catch (error62) {
+        if (enabled)
+          throw error62;
+        return { ...this.#status(binding, { repository: { enabled: false, main_commit: null }, branches: [], own_branch_id: null }, { files: [], hashes: binding.baseline, excluded: 0 }), local_status_unknown: true };
+      }
       if (enabled)
         assertEnabled(cloud);
       binding.automatic_upload = enabled;
@@ -21505,7 +21782,12 @@ var ProjectCodeSync = class _ProjectCodeSync {
     return this.#upload(inventory.hashes);
   }
   async execute(kind, { busy = false, operationId } = {}) {
-    if (busy && ["code_upload", "code_download", "code_recover", "code_auto_upload_enable"].includes(kind)) {
+    if (kind.startsWith("github_") !== (this.#options.storage?.metadata.provider === "github")) {
+      throw new CodeSyncError("code_sync_unsupported", "The requested action belongs to a different code provider.");
+    }
+    if (kind.startsWith("github_"))
+      kind = kind.slice(7);
+    if (busy && ["code_upload", "code_download", "code_recover", "code_auto_upload_enable", "code_update"].includes(kind)) {
       throw new CodeSyncError("code_sync_busy", "An Agent is working in this workspace. Wait until it finishes before syncing code.");
     }
     switch (kind) {
@@ -21521,11 +21803,26 @@ var ProjectCodeSync = class _ProjectCodeSync {
         return this.setAutomaticUpload(true);
       case "code_auto_upload_disable":
         return this.setAutomaticUpload(false);
+      case "code_update": {
+        await this.initialize();
+        if (!this.#options.storage)
+          throw new CodeSyncError("code_sync_unsupported", "Use the cloud review controls to update this branch.");
+        return this.#locked(async () => {
+          const binding = await this.#readBinding();
+          const inventory = await this.#inventory();
+          if (!sameHashes(binding.baseline, inventory.hashes)) {
+            throw new CodeSyncError("code_sync_dirty", "Local source files have unuploaded changes. Upload them or recover the remote version before updating your GitHub branch.");
+          }
+          return this.#status(binding, await this.#options.storage.update(), inventory);
+        });
+      }
       default:
         throw new CodeSyncError("code_sync_unsupported", "Unsupported code sync action.");
     }
   }
   async #cloudStatus() {
+    if (this.#options.storage)
+      return this.#options.storage.status();
     const parsed = CodeStatusSchema.safeParse(await this.#request(""));
     if (!parsed.success)
       throw invalidResponse();
@@ -21534,6 +21831,8 @@ var ProjectCodeSync = class _ProjectCodeSync {
   async #snapshot(cloud) {
     if (!cloud.repository.main_commit && !cloud.own_branch_id)
       throw new CodeSyncError("code_sync_empty", "No code has been uploaded yet.");
+    if (this.#options.storage)
+      return this.#options.storage.snapshot(cloud);
     const parsed = CodeSnapshotResultSchema.safeParse(await this.#request(`/snapshot?branch_id=${encodeURIComponent(cloud.own_branch_id ?? "main")}`));
     if (!parsed.success)
       throw invalidResponse();
@@ -21542,6 +21841,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
   #status(binding, cloud, inventory) {
     const cloudCommit = cloud.branches.find((branch) => branch.id === cloud.own_branch_id)?.head_commit ?? cloud.repository.main_commit;
     return {
+      ...this.#options.storage?.metadata,
       enabled: cloud.repository.enabled,
       automatic_upload: binding.automatic_upload,
       local_changes: changedCount(binding.baseline, inventory.hashes),
@@ -21609,7 +21909,7 @@ var ProjectCodeSync = class _ProjectCodeSync {
   async #readBinding() {
     const file2 = path2.join(this.#stateRoot, "binding.json");
     const info = await lstat2(file2);
-    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_BINDING_BYTES)
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_BINDING_BYTES * (this.#options.storage ? 10 : 1))
       throw new CodeSyncError("code_sync_binding", "Private code sync state is not a regular bounded file.");
     let binding;
     try {
@@ -21624,13 +21924,13 @@ var ProjectCodeSync = class _ProjectCodeSync {
     }
     if (binding.interrupted_download !== void 0 && typeof binding.interrupted_download !== "boolean")
       throw new CodeSyncError("code_sync_binding", "Private download recovery state is invalid.");
-    if (binding.executable_paths !== void 0 && (!Array.isArray(binding.executable_paths) || binding.executable_paths.length > CODE_SYNC_MAX_FILES || binding.executable_paths.some((name2) => typeof name2 !== "string" || !isCodeSyncPathAllowed(name2))))
+    if (binding.executable_paths !== void 0 && (!Array.isArray(binding.executable_paths) || binding.executable_paths.length > this.#limits.maxFiles || binding.executable_paths.some((name2) => typeof name2 !== "string" || !isCodeSyncPathAllowed(name2))))
       throw new CodeSyncError("code_sync_binding", "Private code file-mode state is invalid.");
     const baseline = Object.entries(binding.baseline);
-    if (baseline.length > CODE_SYNC_MAX_FILES)
+    if (baseline.length > this.#limits.maxFiles)
       throw new CodeSyncError("code_sync_binding", "Private code sync baseline exceeds the file limit.");
-    for (const [name2, hash2] of baseline) {
-      if (!isCodeSyncPathAllowed(name2) || typeof hash2 !== "string" || !/^[a-f0-9]{64}$/u.test(hash2))
+    for (const [name2, hash3] of baseline) {
+      if (!isCodeSyncPathAllowed(name2) || typeof hash3 !== "string" || !/^[a-f0-9]{64}$/u.test(hash3))
         throw new CodeSyncError("code_sync_binding", "Private code sync baseline is invalid.");
     }
     return binding;
@@ -21663,19 +21963,23 @@ var ProjectCodeSync = class _ProjectCodeSync {
     const nativeExecutables = /* @__PURE__ */ new Set();
     let candidates;
     let nativeRoot = "";
+    const inventoryOutputLimit = this.#options.storage ? this.#limits.maxFiles * 2100 : 2 * 1024 * 1024;
     try {
       nativeRoot = (await git(["rev-parse", "--show-toplevel"], this.#root)).trim();
     } catch {
     }
     if (nativeRoot && await realpath(nativeRoot) === this.#root) {
-      const trackedEntries = (await git(["ls-files", "--stage", "-z"], this.#root)).split("\0").filter(Boolean);
+      const trackedEntries = (await git(["ls-files", "--stage", "-z"], this.#root, inventoryOutputLimit)).split("\0").filter(Boolean);
       tracked = new Set(trackedEntries.map((entry) => entry.slice(entry.indexOf("	") + 1)));
+      if (this.#options.storage?.metadata.provider === "github" && trackedEntries.some((entry) => !/^(?:100644|100755) /u.test(entry))) {
+        throw new CodeSyncError("code_sync_unsupported", "Tracked links or submodules cannot be synchronized to GitHub. Remove them from the native Git index or use native Git.");
+      }
       for (const entry of trackedEntries)
         if (entry.startsWith("100755 "))
           nativeExecutables.add(entry.slice(entry.indexOf("	") + 1));
-      candidates = [...tracked, ...(await git(["ls-files", "--others", "--exclude-standard", "-z"], this.#root)).split("\0").filter(Boolean)];
+      candidates = [...tracked, ...(await git(["ls-files", "--others", "--exclude-standard", "-z"], this.#root, inventoryOutputLimit)).split("\0").filter(Boolean)];
     } else {
-      candidates = (await git([`--git-dir=${path2.join(this.#stateRoot, "inventory.git")}`, `--work-tree=${this.#root}`, "ls-files", "--others", "--exclude-standard", "-z"], this.#root)).split("\0").filter(Boolean);
+      candidates = (await git([`--git-dir=${path2.join(this.#stateRoot, "inventory.git")}`, `--work-tree=${this.#root}`, "ls-files", "--others", "--exclude-standard", "-z"], this.#root, inventoryOutputLimit)).split("\0").filter(Boolean);
     }
     const binding = await this.#readBinding();
     const executablePaths = executableHints ?? new Set(binding.executable_paths ?? []);
@@ -21688,6 +21992,9 @@ var ProjectCodeSync = class _ProjectCodeSync {
     let totalBytes = 0;
     for (const name2 of [...new Set(candidates)].sort()) {
       if (!isCodeSyncPathAllowed(name2) || BUILD_PATH.test(name2)) {
+        if (this.#options.storage?.metadata.provider === "github" && tracked.has(name2)) {
+          throw new CodeSyncError("code_sync_unsupported", "A tracked private, unsafe or generated path cannot be synchronized to GitHub. Remove it from the native Git index or use native Git.");
+        }
         if (tracked.has(name2) && !BUILD_PATH.test(name2))
           throw new CodeSyncError("code_sync_secret", "A tracked private or unsafe file is excluded from code sync. Remove it from version control before uploading.");
         excluded += 1;
@@ -21695,6 +22002,8 @@ var ProjectCodeSync = class _ProjectCodeSync {
       }
       const target = path2.join(this.#root, ...name2.split("/"));
       if (!await safeAncestors(this.#root, name2)) {
+        if (this.#options.storage?.metadata.provider === "github" && tracked.has(name2))
+          throw new CodeSyncError("code_sync_unsupported", "A tracked path crosses a link or unsafe directory. Use native Git after reviewing it.");
         excluded += 1;
         continue;
       }
@@ -21707,26 +22016,28 @@ var ProjectCodeSync = class _ProjectCodeSync {
         throw error62;
       }
       if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) {
+        if (this.#options.storage?.metadata.provider === "github" && tracked.has(name2))
+          throw new CodeSyncError("code_sync_unsupported", "A tracked link or non-regular file cannot be synchronized to GitHub. Use native Git after reviewing it.");
         excluded += 1;
         continue;
       }
-      if (info.size > CODE_SYNC_MAX_FILE_BYTES)
-        throw new CodeSyncError("code_sync_limit", "A source file exceeds the 2 MiB code sync limit.");
-      const source = await readBoundedSource(target);
-      const bytes = source.bytes;
-      if (containsCodeSyncSecret(bytes.toString("utf8")))
+      if (info.size > this.#limits.maxFileBytes)
+        throw new CodeSyncError("code_sync_limit", "A source file exceeds the selected provider's file limit.");
+      const source = await readBoundedSource(target, this.#limits.maxFileBytes);
+      const bytes2 = source.bytes;
+      if (containsCodeSyncSecret(bytes2.toString("utf8")))
         throw new CodeSyncError("code_sync_secret", "A source file contains a recognizable credential or private key. Remove it before uploading.");
-      totalBytes += bytes.byteLength;
-      if (totalBytes > CODE_SYNC_MAX_SNAPSHOT_BYTES || files.length >= CODE_SYNC_MAX_FILES)
-        throw new CodeSyncError("code_sync_limit", "Code sync is limited to 1,000 files and 8 MiB per checkpoint.");
-      files.push({ path: name2, content_base64: bytes.toString("base64"), executable: process.platform === "win32" ? executablePaths.has(name2) || nativeExecutables.has(name2) : source.executable });
+      totalBytes += bytes2.byteLength;
+      if (totalBytes > this.#limits.maxSnapshotBytes || files.length >= this.#limits.maxFiles)
+        throw new CodeSyncError("code_sync_limit", "Source files exceed the selected provider's checkpoint limit.");
+      files.push({ path: name2, content_base64: bytes2.toString("base64"), executable: process.platform === "win32" ? executablePaths.has(name2) || nativeExecutables.has(name2) : source.executable });
     }
-    if (!CodeFilesSchema.safeParse(files).success)
+    if (!createCodeFilesSchema(this.#limits).safeParse(files).success)
       throw new CodeSyncError("code_sync_unsafe_path", "Source files contain non-portable or conflicting paths.");
     return { files, hashes: fileHashes(files), excluded };
   }
   async #locked(operation) {
-    const lockPath = path2.join(this.#stateRoot, "operation.lock");
+    const lockPath = path2.join(this.#lockRoot, "operation.lock");
     let handle;
     try {
       handle = await open3(lockPath, "wx", 384);
@@ -21798,14 +22109,14 @@ function isWithin(root, target) {
   const relative = path2.relative(root, target);
   return !relative || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative);
 }
-async function git(args, cwd) {
+async function git(args, cwd, maxBuffer = 2 * 1024 * 1024) {
   const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_") && !key.startsWith("GATHERTHREAD_")));
   try {
     const result = await execFileAsync("git", ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args], {
       cwd,
       env: { ...env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null", GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" },
       timeout: 15e3,
-      maxBuffer: 2 * 1024 * 1024,
+      maxBuffer,
       encoding: "utf8",
       windowsHide: true
     });
@@ -21844,7 +22155,7 @@ async function safeAncestors(root, relative, create = false) {
   }
   return true;
 }
-async function fileHash(root, name2, executableHint) {
+async function fileHash(root, name2, executableHint, maxBytes = CODE_SYNC_MAX_FILE_BYTES) {
   if (!await safeAncestors(root, name2))
     throw new CodeSyncError("code_sync_unsafe_path", "A destination directory is a symbolic link or not a directory.");
   const target = path2.join(root, ...name2.split("/"));
@@ -21856,17 +22167,17 @@ async function fileHash(root, name2, executableHint) {
       return;
     throw error62;
   }
-  if (!info.isFile() || info.isSymbolicLink() || info.size > CODE_SYNC_MAX_FILE_BYTES)
+  if (!info.isFile() || info.isSymbolicLink() || info.size > maxBytes)
     throw new CodeSyncError("code_sync_unsafe_path", "A destination is not a bounded regular source file.");
-  const source = await readBoundedSource(target);
+  const source = await readBoundedSource(target, maxBytes);
   const executable = process.platform === "win32" && executableHint !== void 0 ? executableHint : source.executable;
   return digest(`${executable ? "1" : "0"}\0${source.bytes.toString("base64")}`);
 }
-async function readBoundedSource(filename) {
+async function readBoundedSource(filename, maxBytes = CODE_SYNC_MAX_FILE_BYTES) {
   const handle = await open3(filename, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
   try {
     const before = await handle.stat();
-    if (!before.isFile() || before.nlink !== 1 || before.size > CODE_SYNC_MAX_FILE_BYTES)
+    if (!before.isFile() || before.nlink !== 1 || before.size > maxBytes)
       throw new CodeSyncError("code_sync_unsafe_path", "A source path is not a bounded regular file.");
     const buffer = Buffer.alloc(before.size + 1);
     const result = await handle.read(buffer, 0, buffer.length, 0);
@@ -21878,18 +22189,18 @@ async function readBoundedSource(filename) {
     await handle.close();
   }
 }
-async function applySnapshot(root, files, baseline, options) {
-  if (!CodeFilesSchema.safeParse(files).success)
+async function applySnapshot(root, files, baseline, options, limits = CLOUD_CODE_SYNC_LIMITS) {
+  if (!createCodeFilesSchema(limits).safeParse(files).success)
     throw new CodeSyncError("code_sync_unsafe_path", "Cloud code contains unsafe paths.");
   const names = /* @__PURE__ */ new Set([...Object.keys(baseline), ...files.map((file2) => file2.path)]);
   for (const name2 of names) {
-    if (await fileHash(root, name2, options?.baselineExecutables?.has(name2)) !== baseline[name2])
+    if (await fileHash(root, name2, options?.baselineExecutables?.has(name2), limits.maxFileBytes) !== baseline[name2])
       throw new CodeSyncError("code_sync_dirty", "Cloud code would overwrite local or ignored files. Recover into a new folder instead.");
   }
   if (options) {
     await mkdir2(options.backupRoot, { recursive: true, mode: 448 });
     for (const name2 of Object.keys(baseline)) {
-      const source = await readBoundedSource(path2.join(root, ...name2.split("/")));
+      const source = await readBoundedSource(path2.join(root, ...name2.split("/")), limits.maxFileBytes);
       if (process.platform === "win32" && options.baselineExecutables)
         source.executable = options.baselineExecutables.has(name2);
       if (digest(`${source.executable ? "1" : "0"}\0${source.bytes.toString("base64")}`) !== baseline[name2])
@@ -21908,7 +22219,7 @@ async function applySnapshot(root, files, baseline, options) {
   }
   const targetNames = new Set(files.map((file2) => file2.path));
   for (const file2 of files) {
-    if (!await safeAncestors(root, file2.path, true) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path)) !== baseline[file2.path])
+    if (!await safeAncestors(root, file2.path, true) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path), limits.maxFileBytes) !== baseline[file2.path])
       throw new CodeSyncError("code_sync_busy", "Local files changed during download. No further files were applied.");
     const filename = path2.join(root, ...file2.path.split("/"));
     const temporary = path2.join(path2.dirname(filename), `.gatherthread-${randomUUID()}.tmp`);
@@ -21919,7 +22230,7 @@ async function applySnapshot(root, files, baseline, options) {
     } finally {
       await handle.close();
     }
-    if (!await safeAncestors(root, file2.path) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path)) !== baseline[file2.path]) {
+    if (!await safeAncestors(root, file2.path) || await fileHash(root, file2.path, options?.baselineExecutables?.has(file2.path), limits.maxFileBytes) !== baseline[file2.path]) {
       await unlink(temporary);
       throw new CodeSyncError("code_sync_busy", "Source files changed while preparing a download. Original files were backed up; no further files were applied.");
     }
@@ -21927,55 +22238,442 @@ async function applySnapshot(root, files, baseline, options) {
   }
   for (const name2 of Object.keys(baseline)) {
     if (!targetNames.has(name2)) {
-      if (await fileHash(root, name2, options?.baselineExecutables?.has(name2)) !== baseline[name2])
+      if (await fileHash(root, name2, options?.baselineExecutables?.has(name2), limits.maxFileBytes) !== baseline[name2])
         throw new CodeSyncError("code_sync_busy", "Local files changed during download. No further files were applied.");
       await unlink(path2.join(root, ...name2.split("/")));
     }
   }
 }
 
+// ../bridge/dist/src/github-code-sync.js
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat3, mkdir as mkdir3, open as open4, unlink as unlink2 } from "node:fs/promises";
+import path3 from "node:path";
+var hash2 = (text) => createHash3("sha256").update(text).digest("hex");
+var Commit2 = /^[a-f0-9]{40}$/u;
+var filesSchema = createCodeFilesSchema(GITHUB_CODE_SYNC_LIMITS);
+var generatedPath = /(?:^|\/)(?:node_modules|dist|build|coverage|\.next|\.cache|\.turbo|\.venv|venv|__pycache__)(?:\/|$)/u;
+function createGitHubCodeSync(options, runner = runGitHubGit) {
+  return new ProjectCodeSync({ ...options, storage: new GitHubCodeStorage(options, runner) });
+}
+var GitHubCodeStorage = class {
+  limits = GITHUB_CODE_SYNC_LIMITS;
+  key;
+  metadata;
+  #options;
+  #run;
+  #remote;
+  #branchId;
+  #directory = "";
+  #revision;
+  constructor(options, runner) {
+    if (!GitHubConnectionSchema.safeParse({ repository: options.repository, base_branch: options.baseBranch, revision: options.revision, enabled: true }).success) {
+      throw new CodeSyncError("code_sync_binding", "GitHub requires an owner/repository and a valid base branch.");
+    }
+    const branch = `gatherthread/${hash2(options.projectId).slice(0, 24)}/${hash2(options.actorId).slice(0, 24)}`;
+    if (options.baseBranch.startsWith("gatherthread/"))
+      throw new CodeSyncError("code_sync_binding", "Choose a base branch outside GatherThread personal branches.");
+    this.#options = options;
+    this.#run = runner;
+    this.#revision = options.revision;
+    this.#remote = `https://github.com/${options.repository}.git`;
+    this.#branchId = `branch-${hash2(branch).slice(0, 24)}`;
+    this.key = JSON.stringify(["github", options.apiUrl.replace(/\/$/u, "").replace(/\/v1$/u, ""), options.projectId, options.actorId, options.repository.toLowerCase(), options.baseBranch, options.revision]);
+    this.metadata = { provider: "github", repository: options.repository, branch, base_branch: options.baseBranch };
+  }
+  async initialize(privateDirectory) {
+    this.#directory = path3.join(privateDirectory, "github.git");
+    try {
+      if ((await lstat3(this.#directory)).isSymbolicLink())
+        throw new CodeSyncError("code_sync_binding", "Private GitHub state cannot be a symbolic link.");
+    } catch (error62) {
+      if (error62.code !== "ENOENT")
+        throw error62;
+    }
+    await mkdir3(this.#directory, { recursive: true, mode: 448 });
+    await this.#git(["init", "--bare", "--quiet", "."]);
+    const info = path3.join(this.#directory, "info");
+    await mkdir3(info, { recursive: true, mode: 448 });
+    if ((await lstat3(info)).isSymbolicLink())
+      throw new CodeSyncError("code_sync_binding", "Private GitHub attributes directory is unsafe.");
+    const attributes = await open4(path3.join(info, "attributes"), constants2.O_WRONLY | constants2.O_CREAT | (constants2.O_NOFOLLOW ?? 0), 384);
+    try {
+      if (!(await attributes.stat()).isFile() || (await attributes.stat()).nlink !== 1)
+        throw new CodeSyncError("code_sync_binding", "Private GitHub attributes must be a regular file.");
+      await attributes.truncate(0);
+      await attributes.writeFile("* conflict-marker-size=7\n");
+    } finally {
+      await attributes.close();
+    }
+  }
+  async #authorize() {
+    const url2 = new URL(this.#options.apiUrl);
+    url2.pathname = url2.pathname.replace(/\/$/u, "").replace(/\/v1$/u, "") + `/v1/projects/${encodeURIComponent(this.#options.projectId)}/github`;
+    let response;
+    try {
+      response = await (this.#options.fetch ?? fetch)(url2.toString(), {
+        headers: { authorization: `Bearer ${this.#options.token}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      throw new CodeSyncError("code_sync_unavailable", "GatherThread could not verify current GitHub project access.");
+    }
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new CodeSyncError("code_sync_forbidden", "Current GatherThread project access is required for GitHub synchronization.");
+    }
+    if (!response.body)
+      throw new CodeSyncError("code_sync_unavailable", "Invalid GitHub configuration response.");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (; ; ) {
+      const part = await reader.read();
+      if (part.done)
+        break;
+      size += part.value.length;
+      if (size > 16384) {
+        await reader.cancel();
+        throw new CodeSyncError("code_sync_limit", "GitHub configuration response is too large.");
+      }
+      chunks.push(part.value);
+    }
+    let data;
+    try {
+      data = GitHubProjectStatusSchema.parse(JSON.parse(Buffer.concat(chunks).toString("utf8")).data);
+    } catch {
+      throw new CodeSyncError("code_sync_unavailable", "Invalid GitHub configuration response.");
+    }
+    const connection = data.connection;
+    if (!data.can_write || data.branch !== this.metadata.branch || !connection || connection.repository.toLowerCase() !== this.#options.repository.toLowerCase() || connection.base_branch !== this.#options.baseBranch) {
+      throw new CodeSyncError("code_sync_binding", "GitHub target or project permissions changed. Review the connection and authorize it locally again.");
+    }
+    if (!connection.enabled)
+      return false;
+    if (this.#revision !== connection.revision)
+      throw new CodeSyncError("code_sync_binding", "GitHub configuration changed. Reconnect and authorize the current target locally again.");
+    return true;
+  }
+  async #enabled() {
+    if (!await this.#authorize())
+      throw new CodeSyncError("code_sync_disabled", "GitHub synchronization is paused for this project.");
+  }
+  async status() {
+    if (!await this.#authorize())
+      return { repository: { enabled: false, main_commit: null }, branches: [], own_branch_id: null };
+    const refs = (await this.#git(["ls-remote", "--refs", this.#remote, `refs/heads/${this.#options.baseBranch}`, `refs/heads/${this.metadata.branch}`])).toString("utf8");
+    let main = null;
+    let own2 = null;
+    for (const line of refs.trim().split("\n")) {
+      const [oid, ref] = line.split("	");
+      if (!oid || !Commit2.test(oid))
+        continue;
+      if (ref === `refs/heads/${this.#options.baseBranch}`)
+        main = oid;
+      if (ref === `refs/heads/${this.metadata.branch}`)
+        own2 = oid;
+    }
+    return {
+      repository: { enabled: true, main_commit: main },
+      own_branch_id: own2 ? this.#branchId : null,
+      branches: own2 ? [{ id: this.#branchId, name: "My GitHub branch", user_id: this.#options.actorId, head_commit: own2, review_status: "draft" }] : []
+    };
+  }
+  #head(status) {
+    return status.branches[0]?.head_commit ?? status.repository.main_commit;
+  }
+  async #fetch(status) {
+    await this.#enabled();
+    const refs = [];
+    if (status.repository.main_commit)
+      refs.push(`+refs/heads/${this.#options.baseBranch}:refs/gt/base`);
+    if (status.own_branch_id)
+      refs.push(`+refs/heads/${this.metadata.branch}:refs/gt/own`);
+    if (refs.length)
+      await this.#git(["fetch", "--quiet", "--no-tags", "--no-recurse-submodules", this.#remote, ...refs]);
+    for (const [ref, expected] of [["refs/gt/base", status.repository.main_commit], ["refs/gt/own", status.branches[0]?.head_commit]]) {
+      if (expected && (await this.#git(["rev-parse", "--verify", ref])).toString().trim() !== expected)
+        throw conflict();
+    }
+  }
+  async snapshot(status) {
+    const commit = this.#head(status);
+    if (!commit)
+      throw new CodeSyncError("code_sync_empty", "No GitHub files have been uploaded yet.");
+    await this.#fetch(status);
+    return { commit, files: await this.#files(commit) };
+  }
+  async #files(commit) {
+    if (!Commit2.test(commit))
+      throw conflict();
+    const listing = await this.#git(["ls-tree", "-r", "-z", "-l", commit]);
+    if (!Buffer.from(listing.toString("utf8"), "utf8").equals(listing))
+      throw new CodeSyncError("code_sync_unsafe_path", "The GitHub tree contains non-UTF-8 filenames. Use native Git for this repository.");
+    const entries = listing.toString("utf8").split("\0").filter(Boolean).map((entry) => {
+      const match = /^(100644|100755) blob ([a-f0-9]{40})\s+(\d+)\t(.+)$/u.exec(entry);
+      if (!match)
+        throw new CodeSyncError("code_sync_unsupported", "This GitHub tree contains unsupported links, submodules or paths. Use native Git for this repository.");
+      return { mode: match[1], oid: match[2], size: Number(match[3]), path: match[4] };
+    });
+    if (entries.length > this.limits.maxFiles || entries.some((entry) => entry.size > this.limits.maxFileBytes) || entries.reduce((sum, entry) => sum + entry.size, 0) > this.limits.maxSnapshotBytes)
+      throw new CodeSyncError("code_sync_limit", "GitHub source exceeds the supported checkpoint limit. Use native Git for larger trees.");
+    const output2 = entries.length ? await this.#git(["cat-file", "--batch"], Buffer.from(entries.map((entry) => entry.oid).join("\n") + "\n")) : Buffer.alloc(0);
+    let offset = 0;
+    const files = [];
+    for (const entry of entries) {
+      const end = output2.indexOf(10, offset);
+      if (end < 0 || output2.subarray(offset, end).toString() !== `${entry.oid} blob ${entry.size}`)
+        throw conflict();
+      const content = output2.subarray(end + 1, end + 1 + entry.size);
+      offset = end + 2 + entry.size;
+      if (content.length !== entry.size || output2[offset - 1] !== 10)
+        throw conflict();
+      if (generatedPath.test(entry.path) || containsCodeSyncSecret(content.toString("utf8")) || content.subarray(0, 80).toString().startsWith("version https://git-lfs.github.com/spec/v1")) {
+        throw new CodeSyncError("code_sync_unsupported", "This GitHub tree contains excluded generated files, credentials or Git LFS pointers. Nothing was applied; use native Git or a source-only repository.");
+      }
+      files.push({ path: entry.path, content_base64: content.toString("base64"), executable: entry.mode === "100755" });
+    }
+    if (!filesSchema.safeParse(files).success)
+      throw new CodeSyncError("code_sync_unsafe_path", "The GitHub tree contains non-portable or private paths. Nothing was applied.");
+    return files;
+  }
+  async #tree(files) {
+    if (!filesSchema.safeParse(files).success)
+      throw new CodeSyncError("code_sync_limit", "Source tree exceeds GitHub checkpoint limits.");
+    const index = path3.join(this.#directory, `index-${randomUUID2()}`);
+    try {
+      await this.#git(["read-tree", "--empty"], void 0, index);
+      const records = [];
+      for (const file2 of files) {
+        const bytes2 = Buffer.from(file2.content_base64, "base64");
+        if (containsCodeSyncSecret(bytes2.toString("utf8")))
+          throw new CodeSyncError("code_sync_secret", "A recognizable credential was detected in source.");
+        if (generatedPath.test(file2.path) || bytes2.subarray(0, 80).toString().startsWith("version https://git-lfs.github.com/spec/v1"))
+          throw new CodeSyncError("code_sync_unsupported", "Use native Git for Git LFS or generated-file repositories.");
+        const oid = (await this.#git(["hash-object", "-w", "--stdin", "--no-filters"], bytes2)).toString().trim();
+        if (!Commit2.test(oid))
+          throw conflict();
+        records.push(`${file2.executable ? "100755" : "100644"} ${oid}	${file2.path}\0`);
+      }
+      await this.#git(["update-index", "-z", "--index-info"], Buffer.from(records.join("")), index);
+      return (await this.#git(["write-tree"], void 0, index)).toString().trim();
+    } finally {
+      await unlink2(index).catch(() => {
+      });
+    }
+  }
+  async checkpoint(input2) {
+    const status = await this.status();
+    await this.#enabled();
+    const current = this.#head(status);
+    await this.#fetch(status);
+    if (current)
+      await this.#files(current);
+    const tree = await this.#tree(input2.files);
+    if (current && (await this.#git(["rev-parse", `${current}^{tree}`])).toString().trim() === tree)
+      return { status, commit: current };
+    if (input2.base_commit !== current)
+      throw conflict();
+    const commit = (await this.#git(["commit-tree", tree, ...current ? ["-p", current] : [], "-m", "GatherThread workspace checkpoint"])).toString().trim();
+    await this.#push(commit, status);
+    const next = await this.status();
+    if (this.#head(next) !== commit)
+      throw conflict();
+    return { status: next, commit };
+  }
+  async #push(commit, expected) {
+    await this.#enabled();
+    const latest = await this.status();
+    if (this.#head(latest) !== this.#head(expected) || latest.own_branch_id !== expected.own_branch_id)
+      throw conflict();
+    await this.#git(["push", "--porcelain", "--no-verify", this.#remote, `${commit}:refs/heads/${this.metadata.branch}`]);
+  }
+  async update() {
+    const status = await this.status();
+    await this.#enabled();
+    if (!status.own_branch_id || !status.repository.main_commit)
+      return status;
+    await this.#fetch(status);
+    const own2 = this.#head(status);
+    const base = status.repository.main_commit;
+    await this.#files(own2);
+    await this.#files(base);
+    if (own2 === base)
+      return status;
+    try {
+      await this.#git(["merge-base", "--is-ancestor", base, own2]);
+      return status;
+    } catch {
+    }
+    let tree;
+    try {
+      tree = (await this.#git(["merge-tree", "--write-tree", own2, base])).toString().split("\n")[0].trim();
+    } catch {
+      throw new CodeSyncError("code_sync_conflict", "The base branch could not be merged automatically. Resolve conflicts using native Git or GitHub, then download again. Git 2.38 or newer is required.");
+    }
+    if (!Commit2.test(tree))
+      throw conflict();
+    await this.#files(tree);
+    const commit = (await this.#git(["commit-tree", tree, "-p", own2, "-p", base, "-m", "Merge shared GitHub base into my GatherThread branch"])).toString().trim();
+    await this.#push(commit, status);
+    return this.status();
+  }
+  #git(args, input2, index) {
+    return this.#run(args, { cwd: this.#directory, ...input2 ? { input: input2 } : {}, ...index ? { index } : {} });
+  }
+};
+function conflict() {
+  return new CodeSyncError("code_sync_conflict", "GitHub progress changed. Refresh, then download or recover before uploading again.");
+}
+async function runGitHubGit(args, options) {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_") && !key.startsWith("GATHERTHREAD_") && !["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GH_HOST", "GH_PROMPT_DISABLED"].includes(key)));
+  return new Promise((resolve, reject) => {
+    const child = spawn("git", [
+      "-c",
+      "core.hooksPath=/dev/null",
+      "-c",
+      "core.fsmonitor=false",
+      "-c",
+      "commit.gpgSign=false",
+      "-c",
+      "protocol.allow=never",
+      "-c",
+      "protocol.https.allow=always",
+      "-c",
+      "http.followRedirects=false",
+      "-c",
+      "credential.helper=",
+      "-c",
+      "credential.helper=!gh auth git-credential",
+      "-c",
+      "credential.interactive=false",
+      "-c",
+      "user.name=GatherThread",
+      "-c",
+      "user.email=checkpoint@users.noreply.github.com",
+      ...args
+    ], {
+      cwd: options.cwd,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null", GIT_TERMINAL_PROMPT: "0", GCM_INTERACTIVE: "never", ...options.index ? { GIT_INDEX_FILE: options.index } : {} }
+    });
+    const chunks = [];
+    let size = 0;
+    let failed = false;
+    const fail = () => {
+      if (failed)
+        return;
+      failed = true;
+      child.kill();
+      reject(new CodeSyncError("code_sync_unavailable", "GitHub Git operation failed. Check Git 2.38+, GitHub CLI login, repository access and network. No credentials are sent through GatherThread."));
+    };
+    const timer = setTimeout(fail, 12e4);
+    timer.unref();
+    child.stdout.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > GITHUB_CODE_SYNC_LIMITS.maxSnapshotBytes + 8 * 1024 * 1024)
+        fail();
+      else
+        chunks.push(chunk);
+    });
+    child.stderr.resume();
+    child.stdin.on("error", () => {
+    });
+    child.on("error", fail);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code !== 0)
+        fail();
+      else if (!failed)
+        resolve(Buffer.concat(chunks));
+    });
+    child.stdin.end(options.input);
+  });
+}
+
+// ../bridge/dist/src/github-auth.js
+import { spawn as spawn2 } from "node:child_process";
+async function connectGitHubAccount(command = runGitHubAuthCommand) {
+  if (await command(["auth", "status", "--hostname", "github.com"], 1e4))
+    return;
+  const signedIn = await command(["auth", "login", "--hostname", "github.com", "--git-protocol", "https", "--web", "--clipboard"], 24e4);
+  if (!signedIn || !await command(["auth", "status", "--hostname", "github.com"], 1e4)) {
+    throw new CodeSyncError("github_auth_failed", "GitHub sign-in was not completed on this device. Reopen the connection and finish in your browser.");
+  }
+}
+function runGitHubAuthCommand(args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GH_HOST", "GH_PROMPT_DISABLED"].includes(key)));
+    const child = spawn2("gh", [...args], { env, windowsHide: true, stdio: ["ignore", "ignore", "ignore"] });
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      finish(false);
+    }, timeoutMs);
+    child.on("error", (error62) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new CodeSyncError(error62.code === "ENOENT" ? "github_cli_unavailable" : "github_auth_failed", error62.code === "ENOENT" ? "Install GitHub CLI on this device before connecting." : "GitHub CLI could not start on this device."));
+    });
+    child.on("close", (code) => finish(code === 0));
+  });
+}
+
 // dist/src/native-plugin.js
-import { createHash as createHash8 } from "node:crypto";
-import path9 from "node:path";
+import { createHash as createHash10 } from "node:crypto";
+import path10 from "node:path";
 
 // dist/src/code-sync-controller.js
-import { constants as constants2 } from "node:fs";
-import { lstat as lstat4, mkdir as mkdir3, open as open4, rename as rename2, unlink as unlink2 } from "node:fs/promises";
-import { randomUUID as randomUUID2 } from "node:crypto";
-import path4 from "node:path";
+import { constants as constants3 } from "node:fs";
+import { lstat as lstat5, mkdir as mkdir4, open as open5, rename as rename2, unlink as unlink3 } from "node:fs/promises";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import path5 from "node:path";
 
 // dist/src/path-security.js
-import { lstat as lstat3, realpath as realpath2 } from "node:fs/promises";
-import path3 from "node:path";
+import { lstat as lstat4, realpath as realpath2 } from "node:fs/promises";
+import path4 from "node:path";
 async function prospectiveRealPath(candidate) {
-  let current = path3.resolve(candidate);
+  let current = path4.resolve(candidate);
   const missing = [];
   while (true) {
     try {
-      return path3.join(await realpath2(current), ...missing);
+      return path4.join(await realpath2(current), ...missing);
     } catch (error62) {
       if (!isNodeError2(error62) || error62.code !== "ENOENT")
         throw error62;
-      const parent = path3.dirname(current);
+      const parent = path4.dirname(current);
       if (parent === current)
         throw new Error(`No existing ancestor for path: ${candidate}`);
-      missing.unshift(path3.basename(current));
+      missing.unshift(path4.basename(current));
       current = parent;
     }
   }
 }
 async function secureDirectoryChain(directory) {
-  const absolute = path3.resolve(directory);
-  const root = path3.parse(absolute).root;
-  const relative = path3.relative(root, absolute);
-  const components = relative ? relative.split(path3.sep) : [];
+  const absolute = path4.resolve(directory);
+  const root = path4.parse(absolute).root;
+  const relative = path4.relative(root, absolute);
+  const components = relative ? relative.split(path4.sep) : [];
   const identities = [];
   let current = root;
   for (const component of components) {
-    current = path3.join(current, component);
+    current = path4.join(current, component);
     let metadata;
     try {
-      metadata = await lstat3(current);
+      metadata = await lstat4(current);
     } catch (error62) {
       if (isNodeError2(error62) && error62.code === "ENOENT")
         break;
@@ -22012,6 +22710,7 @@ var ACTIONS = /* @__PURE__ */ new Set([
   "code_auto_upload_enable",
   "code_auto_upload_disable"
 ]);
+var GITHUB_CODE_ACTIONS = githubCodeSyncRequestKinds.filter((kind) => kind !== "github_auth_connect");
 var DshCodeSyncController = class {
   #authorized = false;
   #status;
@@ -22021,8 +22720,10 @@ var DshCodeSyncController = class {
   #poll;
   #stopped = false;
   #options;
+  #actions;
   constructor(options) {
     this.#options = options;
+    this.#actions = options.actionKinds ? new Set(options.actionKinds) : ACTIONS;
   }
   view() {
     return {
@@ -22091,7 +22792,7 @@ var DshCodeSyncController = class {
           if (this.#stopped)
             return;
           const runtime = runtimes.get(job.sessionId);
-          if (!runtime || job.targetRuntimeId !== runtime || !ACTIONS.has(job.kind))
+          if (!runtime || job.targetRuntimeId !== runtime || !this.#actions.has(job.kind))
             continue;
           let claimed;
           try {
@@ -22134,11 +22835,11 @@ var DshCodeSyncController = class {
     await this.#tail;
   }
   async #execute(kind, operationId) {
-    if (!ACTIONS.has(kind))
+    if (!this.#actions.has(kind))
       throw new CodeSyncLocalError("code_action_invalid");
     if (!this.#authorized)
       throw new CodeSyncLocalError("code_sync_disabled");
-    if (this.#options.isBusy() && kind !== "code_sync_status" && kind !== "code_auto_upload_disable") {
+    if (this.#options.isBusy() && !["code_sync_status", "code_auto_upload_disable", "github_code_sync_status", "github_code_auto_upload_disable"].includes(kind)) {
       throw new CodeSyncLocalError("code_sync_busy");
     }
     return this.#requireEngine().execute(kind, {
@@ -22169,13 +22870,13 @@ var CodeSyncLocalError = class extends Error {
 };
 function codeSyncErrorCode(error62) {
   const code = typeof error62 === "object" && error62 !== null && "code" in error62 ? error62.code : void 0;
-  return typeof code === "string" && /^code_[a-z_]{1,60}$/u.test(code) ? code : "code_sync_failed";
+  return typeof code === "string" && /^(?:github_)?code_[a-z_]{1,60}$/u.test(code) ? code : "code_sync_failed";
 }
 async function loadConsent(file2, binding) {
-  const ancestors = await secureDirectoryChain(path4.dirname(file2));
+  const ancestors = await secureDirectoryChain(path5.dirname(file2));
   let before;
   try {
-    before = await lstat4(file2);
+    before = await lstat5(file2);
   } catch (error62) {
     if (error62.code === "ENOENT")
       return false;
@@ -22184,25 +22885,25 @@ async function loadConsent(file2, binding) {
   if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > 4096 || process.platform !== "win32" && (before.mode & 63) !== 0) {
     throw new CodeSyncLocalError("code_consent_invalid");
   }
-  const handle = await open4(file2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+  const handle = await open5(file2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
   try {
     const opened = await handle.stat();
     if (before.dev !== opened.dev || before.ino !== opened.ino)
       throw new CodeSyncLocalError("code_consent_invalid");
     const value = JSON.parse(await handle.readFile("utf8"));
-    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path4.dirname(file2)));
+    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path5.dirname(file2)));
     return value.version === 1 && value.binding === binding && value.enabled === true;
   } finally {
     await handle.close();
   }
 }
 async function saveConsent(file2, binding, enabled) {
-  await secureDirectoryChain(path4.dirname(file2));
-  await mkdir3(path4.dirname(file2), { recursive: true, mode: 448 });
-  const ancestors = await secureDirectoryChain(path4.dirname(file2));
+  await secureDirectoryChain(path5.dirname(file2));
+  await mkdir4(path5.dirname(file2), { recursive: true, mode: 448 });
+  const ancestors = await secureDirectoryChain(path5.dirname(file2));
   await loadConsent(file2, binding);
-  const temporary = `${file2}.${randomUUID2()}.tmp`;
-  const handle = await open4(temporary, "wx", 384);
+  const temporary = `${file2}.${randomUUID3()}.tmp`;
+  const handle = await open5(temporary, "wx", 384);
   try {
     await handle.writeFile(JSON.stringify({ version: 1, binding, enabled }));
     await handle.sync();
@@ -22210,14 +22911,136 @@ async function saveConsent(file2, binding, enabled) {
     await handle.close();
   }
   try {
-    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path4.dirname(file2)));
+    assertSameDirectoryChain(ancestors, await secureDirectoryChain(path5.dirname(file2)));
     await rename2(temporary, file2);
   } catch (error62) {
-    await unlink2(temporary).catch(() => void 0);
+    await unlink3(temporary).catch(() => void 0);
     throw error62;
   }
 }
 
+// dist/src/github-code-sync-controller.js
+import { createHash as createHash4 } from "node:crypto";
+var DshGitHubCodeSyncController = class {
+  options;
+  #controller;
+  #metadata;
+  #key;
+  #error;
+  #tail = Promise.resolve();
+  #stopped = false;
+  #poll;
+  constructor(options) {
+    this.options = options;
+  }
+  view() {
+    return {
+      ...this.#controller?.view() ?? { authorized: false },
+      connection: this.#metadata?.connection ? { ...this.#metadata.connection } : null,
+      branch: this.#metadata?.branch ?? null,
+      ...this.#error ? { error: this.#error } : {}
+    };
+  }
+  async start() {
+    await this.#serialize(async () => {
+      await this.#refresh();
+    });
+  }
+  authorize(enabled, expected) {
+    return this.#serialize(async () => {
+      if (!enabled) {
+        await this.#controller?.authorize(false);
+        return this.view();
+      }
+      await this.#refresh();
+      const target = this.#metadata?.connection;
+      if (!target || !expected || targetKey(target) !== targetKey(expected))
+        throw coded("code_github_binding_changed");
+      if (!this.#metadata?.can_write || !target.enabled)
+        throw coded("code_sync_forbidden");
+      await this.#controller.authorize(true);
+      return this.view();
+    });
+  }
+  execute(kind) {
+    return this.#serialize(async () => {
+      if (kind === "github_code_auto_upload_disable" && this.#controller) {
+        await this.#controller.execute(kind);
+        return this.view();
+      }
+      await this.#refresh();
+      if (kind === "github_code_sync_status" && !this.#controller?.view().authorized)
+        return this.view();
+      if (!this.#controller)
+        throw coded("code_github_not_configured");
+      if (!this.#metadata?.connection?.enabled && kind !== "github_code_sync_status")
+        throw coded("code_not_enabled");
+      await this.#controller.execute(kind);
+      return this.view();
+    });
+  }
+  poll() {
+    if (this.#stopped)
+      return Promise.resolve();
+    this.#poll ??= this.#serialize(async () => {
+      await this.#refresh();
+      await this.#controller?.poll();
+    }).finally(() => {
+      this.#poll = void 0;
+    });
+    return this.#poll;
+  }
+  async stop() {
+    this.#stopped = true;
+    await this.#tail;
+    await this.#controller?.stop();
+  }
+  async #refresh() {
+    const metadata = await this.options.readMetadata();
+    const target = metadata.connection;
+    const key = target && metadata.can_write ? targetKey(target) : void 0;
+    if (key !== this.#key) {
+      await this.#controller?.authorize(false);
+      await this.#controller?.stop();
+      this.#controller = void 0;
+      this.#key = void 0;
+      if (target && key) {
+        const capturedTarget = { ...target };
+        this.#controller = new DshCodeSyncController({
+          ...this.options,
+          binding: createHash4("sha256").update(JSON.stringify([this.options.binding, key])).digest("hex"),
+          actionKinds: GITHUB_CODE_ACTIONS,
+          createEngine: () => this.options.createEngine(capturedTarget)
+        });
+        await this.#controller.start();
+        this.#key = key;
+      }
+    }
+    this.#metadata = metadata;
+  }
+  #serialize(operation) {
+    const pending = this.#tail.then(async () => {
+      if (this.#stopped)
+        throw coded("code_sync_stopped");
+      this.#error = void 0;
+      try {
+        return await operation();
+      } catch (error62) {
+        this.#error = codeSyncErrorCode(error62);
+        throw coded(this.#error);
+      }
+    });
+    this.#tail = pending.catch(() => void 0);
+    return pending;
+  }
+};
+function targetKey(target) {
+  return JSON.stringify([target.repository, target.base_branch, target.revision]);
+}
+function coded(code) {
+  return Object.assign(new Error(code), { code });
+}
+
 // dist/src/collaboration-api.js
 function createHttpDshCollaborationApi(options) {
   const client = new HttpCollaborationClient({
@@ -22293,9 +23116,9 @@ function clipToUtf8Bytes(value, maxBytes) {
 }
 
 // dist/src/config.js
-import { createHash as createHash3 } from "node:crypto";
-import { lstat as lstat5 } from "node:fs/promises";
-import path5 from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { lstat as lstat6 } from "node:fs/promises";
+import path6 from "node:path";
 var CONFIG_KEYS = /* @__PURE__ */ new Set([
   "enabled",
   "bindingMode",
@@ -22408,7 +23231,7 @@ async function assertSafeDshStateRoot(config2) {
   await assertRealStateSeparation(config2.workspacePath, config2.stateRoot, "config.stateRoot");
   await secureDirectoryChain(config2.stateRoot);
   try {
-    const target = await lstat5(config2.stateRoot);
+    const target = await lstat6(config2.stateRoot);
     if (target.isSymbolicLink() || !target.isDirectory()) {
       throw new Error("config.stateRoot must be a real directory, never a symbolic link");
     }
@@ -22437,11 +23260,11 @@ function rejectModeKeys(value, forbidden, bindingMode) {
   }
 }
 function deriveDshSessionId(projectId, sessionId, workspacePath) {
-  const digest3 = createHash3("sha256").update(JSON.stringify([projectId, sessionId, path5.resolve(workspacePath)])).digest("hex").slice(0, 32);
+  const digest3 = createHash5("sha256").update(JSON.stringify([projectId, sessionId, path6.resolve(workspacePath)])).digest("hex").slice(0, 32);
   return `gatherthread-${digest3}`;
 }
 function deriveNativeDshSessionId(projectId, sessionId, workspacePath) {
-  const digest3 = createHash3("sha256").update(JSON.stringify(["native-web-v2", projectId, sessionId, path5.resolve(workspacePath)])).digest("hex").slice(0, 32);
+  const digest3 = createHash5("sha256").update(JSON.stringify(["native-web-v2", projectId, sessionId, path6.resolve(workspacePath)])).digest("hex").slice(0, 32);
   return `gatherthread-${digest3}`;
 }
 function normalizeApiUrl(value) {
@@ -22479,13 +23302,13 @@ function safeText(value, label, maximum) {
 }
 function absolutePath(value, label) {
   const text = requiredString2(value, label, 4096);
-  if (!path5.isAbsolute(text))
+  if (!path6.isAbsolute(text))
     throw new Error(`${label} must be absolute`);
-  return path5.resolve(text);
+  return path6.resolve(text);
 }
 function isWithin2(parent, candidate) {
-  const relative = path5.relative(parent, candidate);
-  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== "..";
+  const relative = path6.relative(parent, candidate);
+  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== "..";
 }
 function isNodeError3(error62) {
   return error62 instanceof Error && "code" in error62;
@@ -22524,7 +23347,7 @@ function rejectUnknownKeys(value, allowed, label) {
 }
 
 // dist/src/connector.js
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 
 // dist/src/canonical-prompt.js
 var MAX_EVENT_TEXT_BYTES = 8 * 1024;
@@ -22597,12 +23420,12 @@ ${footer}`, "utf8");
   const retained = [];
   let used = 0;
   for (const line of contextLines.toReversed()) {
-    const bytes = Buffer.byteLength(`${line}
+    const bytes2 = Buffer.byteLength(`${line}
 `, "utf8");
-    if (used + bytes > contextBudget)
+    if (used + bytes2 > contextBudget)
       continue;
     retained.push(line);
-    used += bytes;
+    used += bytes2;
   }
   retained.reverse();
   const omitted = retained.length < contextLines.length ? [`[${contextLines.length - retained.length} older public context update(s) omitted by size limit]`] : [];
@@ -22916,6 +23739,15 @@ var DshHostConnector = class {
   get stopped() {
     return this.#stopped;
   }
+  /** Project refresh is authoritative for the mode of future DSH bubbles. */
+  updateSessionSummary(session) {
+    if (!this.#started || this.#stopped)
+      throw new Error("DSH connector is not running");
+    if (session.id !== this.#config.sessionId || session.projectId !== this.#config.projectId || session.state !== "active" || !isSessionWritableBy(session, this.#actorUserId)) {
+      throw new Error("Refreshed GatherThread Session is not this writable binding");
+    }
+    this.#session = session;
+  }
   /**
    * Adopt a refreshed execution-profile catalog on a running connection.
    *
@@ -23577,7 +24409,7 @@ var DshHostConnector = class {
           role: "user",
           content,
           occurredAt: event.timestamp,
-          ...event.actorDisplayName === void 0 ? {} : {
+          ...this.#session?.mode !== "multi" || event.actorDisplayName === void 0 ? {} : {
             actorDisplayName: event.actorDisplayName
           }
         });
@@ -24011,7 +24843,7 @@ function turnSettlement(events) {
   return typeof reason?.kind === "string" ? reason.kind : void 0;
 }
 function digest2(value) {
-  return createHash4("sha256").update(value).digest("hex");
+  return createHash6("sha256").update(value).digest("hex");
 }
 function cloneExecutionProfiles(profiles) {
   return profiles.map((profile) => ({
@@ -24147,7 +24979,7 @@ function asObject3(value) {
 }
 
 // dist/src/dsh-compat.js
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 var DSH_COMPATIBILITY = Object.freeze({
   tag: "dsh-v0.1.3-alpha.1",
   version: "0.1.3-alpha.1",
@@ -24193,8 +25025,8 @@ function createDshHostFacade(options) {
   let executionHandle;
   let contextPreparationPromise;
   const executionBinding = JSON.stringify({ nativeSessionId: options.sessionId, ...options.contextBinding });
-  const executionSessionId = `gatherthread-execution-${createHash5("sha256").update(executionBinding).digest("hex").slice(0, 32)}`;
-  const executionOwnerId = `gatherthread-execution-owner:${createHash5("sha256").update(executionBinding).digest("hex")}`;
+  const executionSessionId = `gatherthread-execution-${createHash7("sha256").update(executionBinding).digest("hex").slice(0, 32)}`;
+  const executionOwnerId = `gatherthread-execution-owner:${createHash7("sha256").update(executionBinding).digest("hex")}`;
   const executionOwnerText = JSON.stringify({
     version: 1,
     owner: "gatherthread",
@@ -24302,7 +25134,7 @@ function createDshHostFacade(options) {
     if (input2.selectedOnly && historyContext.items.length !== 0) {
       throw new Error("Selected-only summary execution cannot include other shared history");
     }
-    await open6();
+    await open7();
     if (disposed || promptActive || projectionActive)
       throw new Error("DSH host facade permits only one active write");
     const parent = requireAgent(handle);
@@ -24323,7 +25155,7 @@ function createDshHostFacade(options) {
         throw new Error("DSH isolated Agent did not inherit its native Agent's exact tool composition");
       }
     };
-    const markerId = `gatherthread-context:${createHash5("sha256").update(JSON.stringify({
+    const markerId = `gatherthread-context:${createHash7("sha256").update(JSON.stringify({
       requestId: input2.requestId,
       requestSequence: input2.requestSequence,
       selectedOnly: input2.selectedOnly,
@@ -24422,7 +25254,7 @@ ${JSON.stringify(historyContext.items)}`;
     }
     await presets.mount(agentContext, recorded ?? options.agentPreset);
   };
-  const open6 = () => {
+  const open7 = () => {
     if (disposed)
       return Promise.reject(new Error("DSH host facade is disposed"));
     if (openPromise !== void 0)
@@ -24531,7 +25363,7 @@ ${JSON.stringify(historyContext.items)}`;
     let selectionRef;
     try {
       if (requestedExecutionId === void 0)
-        await open6();
+        await open7();
       throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
       const agent = operationAgent(requestedExecutionId);
       if (requestedExecutionId !== void 0) {
@@ -24551,7 +25383,7 @@ ${JSON.stringify(historyContext.items)}`;
         }
       }
       const fromSequence = agent.session.seq;
-      const message = requestedExecutionId === void 0 ? await createUserMessage(text, options) : await createIsolatedMessage(`gatherthread-request:${createHash5("sha256").update(`${requestedExecutionId}:${fromSequence}:${text}`).digest("hex")}`, text, options);
+      const message = requestedExecutionId === void 0 ? await createUserMessage(text, options) : await createIsolatedMessage(`gatherthread-request:${createHash7("sha256").update(`${requestedExecutionId}:${fromSequence}:${text}`).digest("hex")}`, text, options);
       throwIfDisposed(disposed, lifecycleAbort.signal, "prompt");
       if (agent.status !== "idle" || agent.session.seq !== fromSequence)
         throw new Error("DSH Agent changed while preparing a GatherThread prompt");
@@ -24582,7 +25414,7 @@ ${JSON.stringify(historyContext.items)}`;
   const flush = async () => {
     if (disposed)
       throw new Error("DSH host facade is disposed");
-    await open6();
+    await open7();
     throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
     await sessions.flush(requireAgent(handle).session);
     throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
@@ -24596,7 +25428,7 @@ ${JSON.stringify(historyContext.items)}`;
       return;
     projectionActive = true;
     try {
-      await open6();
+      await open7();
       throwIfDisposed(disposed, lifecycleAbort.signal, "projection");
       const agent = requireAgent(handle);
       if (agent.status !== "idle") {
@@ -24655,7 +25487,7 @@ ${JSON.stringify(historyContext.items)}`;
   };
   return {
     sessionId: options.sessionId,
-    open: open6,
+    open: open7,
     currentSequence(requestedExecutionId) {
       return operationAgent(requestedExecutionId).session.seq;
     },
@@ -24903,8 +25735,11 @@ async function createProjectionMessage(projection, options) {
   });
 }
 function formatProjectionText(projection) {
-  if (projection.role === "user")
-    return projection.content;
+  if (projection.role === "user") {
+    const sender = projection.actorDisplayName?.replace(/[\p{Cc}\p{Cf}【】]+/gu, " ").replace(/\s+/gu, " ").trim();
+    return sender ? `\u3010${sender} \xB7 GatherThread\u3011
+${projection.content}` : projection.content;
+  }
   const route = [projection.provider, projection.model].filter(Boolean).join(" / ");
   const attribution = [projection.actorDisplayName, route].filter(Boolean).join(" \xB7 ");
   return `[GatherThread remote Agent reply${attribution ? ` \xB7 ${attribution}` : ""}]
@@ -25069,9 +25904,9 @@ function asObject4(value) {
 }
 
 // dist/src/native-connection.js
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import path6 from "node:path";
+import path7 from "node:path";
 var DSH_NATIVE_CREDENTIAL_KEY = "gatherthread-dsh-host/default";
 var DSH_NATIVE_GRANT_SCHEMA_VERSION = 2;
 var DSH_NATIVE_PAIRING_CHANNEL = "/gatherthread";
@@ -25204,7 +26039,7 @@ function createNativeProjectConfig(options) {
     projectId: options.binding.projectId,
     projectName: options.binding.projectName,
     deviceId: options.grant.deviceId,
-    workspacePath: path6.resolve(options.workspacePath),
+    workspacePath: path7.resolve(options.workspacePath),
     stateRoot,
     provider: options.binding.provider,
     model: options.binding.model,
@@ -25293,12 +26128,12 @@ function normalizeDshServerUrl(value) {
   return { serverUrl, apiUrl: `${serverUrl}/v1` };
 }
 function nativeStateRoot(dshHome, serverUrl, projectId, workspacePath) {
-  const digest3 = createHash6("sha256").update(JSON.stringify([serverUrl, projectId, path6.resolve(workspacePath)])).digest("hex").slice(0, 32);
-  return path6.join(path6.resolve(dshHome), "gatherthread", "state", digest3);
+  const digest3 = createHash8("sha256").update(JSON.stringify([serverUrl, projectId, path7.resolve(workspacePath)])).digest("hex").slice(0, 32);
+  return path7.join(path7.resolve(dshHome), "gatherthread", "state", digest3);
 }
 function resolveDshHome(env) {
   const configured = env.DSH_HOME?.trim();
-  return path6.resolve(configured ? configured : path6.join(homedir3(), ".dsh"));
+  return path7.resolve(configured ? configured : path7.join(homedir3(), ".dsh"));
 }
 function parseBinding(value) {
   const input2 = exactObject(value, /* @__PURE__ */ new Set([
@@ -25442,8 +26277,8 @@ function isLoopback2(hostname3) {
 }
 
 // dist/src/project-manager.js
-import path7 from "node:path";
-import { createHash as createHash7 } from "node:crypto";
+import path8 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
 
 // dist/src/execution-gate.js
 var BoundedDshExecutionGate = class {
@@ -25722,6 +26557,27 @@ var DshProjectManager = class {
     for (const error62 of permissions.errors)
       this.#reportError(error62);
     const eligibleSessions = [...permissions.eligibleSessions];
+    const sessionUpdateErrors = [];
+    for (const session of eligibleSessions) {
+      const binding = this.#managed.get(session.id);
+      if (binding?.phase === "active" && !binding.connector.stopped) {
+        try {
+          binding.connector.updateSessionSummary(session);
+        } catch (error62) {
+          this.#managed.delete(session.id);
+          try {
+            await binding.connector.stop();
+          } catch (stopError) {
+            this.#reportError(publicError2(stopError, "DSH Session connector cleanup failed"));
+          }
+          if (!this.#stopped)
+            this.#recordFailure(session.id);
+          const failure2 = publicError2(error62, `DSH Session ${session.id} mode refresh failed`);
+          sessionUpdateErrors.push(failure2);
+          this.#reportError(failure2);
+        }
+      }
+    }
     if (this.#discoverLocalSessions !== void 0) {
       try {
         const candidates2 = await this.#discoverLocalSessions();
@@ -25765,7 +26621,7 @@ var DshProjectManager = class {
       status: "updated",
       eligibleSessionIds: [...eligibleIds].sort(),
       activeSessionIds: this.activeSessionIds(),
-      errors: [...permissions.errors, ...attachErrors]
+      errors: [...permissions.errors, ...sessionUpdateErrors, ...attachErrors]
     };
     this.#notifyStatus({
       state: "connected",
@@ -25880,7 +26736,7 @@ function projectSessionConfig(config2, sessionId, nativeSessionId) {
     sessionId,
     deviceId: config2.deviceId,
     workspacePath: config2.workspacePath,
-    statePath: path7.join(config2.stateRoot, `${dshSessionId}.json`),
+    statePath: path8.join(config2.stateRoot, `${dshSessionId}.json`),
     provider: config2.provider,
     model: config2.model,
     ...config2.executionProfiles === void 0 ? {} : {
@@ -25898,7 +26754,7 @@ function projectSessionConfig(config2, sessionId, nativeSessionId) {
   };
 }
 function nativeSessionCreationKey(projectId, localSessionId) {
-  const identity = createHash7("sha256").update(`${projectId}\0${localSessionId}`).digest("hex");
+  const identity = createHash9("sha256").update(`${projectId}\0${localSessionId}`).digest("hex");
   return `dsh-native:${identity}`;
 }
 function retryDelay(config2, attempts) {
@@ -25928,31 +26784,31 @@ function publicError2(error62, fallback) {
 }
 
 // dist/src/state-store.js
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { constants as constants3 } from "node:fs";
-import { lstat as lstat6, mkdir as mkdir4, open as open5, rename as rename3, unlink as unlink3 } from "node:fs/promises";
-import path8 from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { constants as constants4 } from "node:fs";
+import { lstat as lstat7, mkdir as mkdir5, open as open6, rename as rename3, unlink as unlink4 } from "node:fs/promises";
+import path9 from "node:path";
 var FileConnectorStateStore = class {
   #path;
   constructor(statePath) {
-    if (!path8.isAbsolute(statePath))
+    if (!path9.isAbsolute(statePath))
       throw new Error("DSH connector state path must be absolute");
-    this.#path = path8.resolve(statePath);
+    this.#path = path9.resolve(statePath);
   }
   async load() {
-    const directory = path8.dirname(this.#path);
+    const directory = path9.dirname(this.#path);
     const ancestorsBefore = await secureDirectoryChain(directory);
     let metadata;
     try {
-      metadata = await lstat6(this.#path);
+      metadata = await lstat7(this.#path);
     } catch (error62) {
       if (isNodeError4(error62) && error62.code === "ENOENT")
         return void 0;
       throw error62;
     }
     assertPrivateRegularFile(metadata, "DSH connector state");
-    const noFollow = "O_NOFOLLOW" in constants3 ? constants3.O_NOFOLLOW : 0;
-    const handle = await open5(this.#path, constants3.O_RDONLY | noFollow);
+    const noFollow = "O_NOFOLLOW" in constants4 ? constants4.O_NOFOLLOW : 0;
+    const handle = await open6(this.#path, constants4.O_RDONLY | noFollow);
     let raw;
     try {
       const opened = await handle.stat();
@@ -25974,17 +26830,17 @@ var FileConnectorStateStore = class {
   }
   async save(state) {
     const validated = validateConnectorState(structuredClone(state));
-    const directory = path8.dirname(this.#path);
+    const directory = path9.dirname(this.#path);
     await secureDirectoryChain(directory);
-    await mkdir4(directory, { recursive: true, mode: 448 });
+    await mkdir5(directory, { recursive: true, mode: 448 });
     const ancestorsBefore = await secureDirectoryChain(directory);
-    const directoryBefore = await lstat6(directory);
+    const directoryBefore = await lstat7(directory);
     assertSecureDirectory(directoryBefore);
     const targetBefore = await optionalLstat(this.#path);
     if (targetBefore !== void 0)
       assertPrivateRegularFile(targetBefore, "DSH connector state");
-    const temporaryPath = `${this.#path}.tmp-${process.pid}-${randomUUID3()}`;
-    const handle = await open5(temporaryPath, "wx", 384);
+    const temporaryPath = `${this.#path}.tmp-${process.pid}-${randomUUID4()}`;
+    const handle = await open6(temporaryPath, "wx", 384);
     try {
       await handle.writeFile(`${JSON.stringify(validated, null, 2)}
 `, { encoding: "utf8" });
@@ -25993,7 +26849,7 @@ var FileConnectorStateStore = class {
       await handle.close();
     }
     try {
-      const directoryAfter = await lstat6(directory);
+      const directoryAfter = await lstat7(directory);
       if (directoryAfter.isSymbolicLink() || directoryAfter.dev !== directoryBefore.dev || directoryAfter.ino !== directoryBefore.ino) {
         throw new Error("DSH connector state directory changed during atomic save");
       }
@@ -26004,9 +26860,9 @@ var FileConnectorStateStore = class {
       }
       await rename3(temporaryPath, this.#path);
       assertSameDirectoryChain(ancestorsBefore, await secureDirectoryChain(directory));
-      assertPrivateRegularFile(await lstat6(this.#path), "DSH connector state");
+      assertPrivateRegularFile(await lstat7(this.#path), "DSH connector state");
     } catch (error62) {
-      await unlink3(temporaryPath).catch(() => void 0);
+      await unlink4(temporaryPath).catch(() => void 0);
       throw error62;
     }
   }
@@ -26269,7 +27125,7 @@ function isNodeError4(error62) {
 }
 async function optionalLstat(target) {
   try {
-    return await lstat6(target);
+    return await lstat7(target);
   } catch (error62) {
     if (isNodeError4(error62) && error62.code === "ENOENT")
       return void 0;
@@ -26526,7 +27382,10 @@ var RPC_ENDPOINTS = /* @__PURE__ */ new Set([
   "sync/set-auto-upload",
   "sync/upload",
   "code/authorize",
-  "code/action"
+  "code/action",
+  "github/authorize",
+  "github/action",
+  "github/connect"
 ]);
 var MAX_CATALOG_PROVIDERS = 64;
 var MAX_CATALOG_MODELS = 256;
@@ -26628,6 +27487,12 @@ var DshNativeHostController = class {
               projectName: this.#projects.get(projectId)?.name ?? projectId,
               ...view
             }];
+          }).slice(0, 100),
+          githubSync: [...this.#owners].flatMap(([projectId, owner]) => {
+            if (this.#projects.get(projectId)?.role === "viewer")
+              return [];
+            const view = owner.githubSyncView?.();
+            return view === void 0 ? [] : [{ projectId, projectName: this.#projects.get(projectId)?.name ?? projectId, ...view }];
           }).slice(0, 100)
         }
       },
@@ -26889,6 +27754,40 @@ var DshNativeHostController = class {
     }
     return this.publicState();
   }
+  async githubSyncAction(inputValue, authorize = false) {
+    this.#assertAvailable();
+    const input2 = exactInput(inputValue, new Set(authorize ? ["projectId", "enabled", "repository", "base_branch", "revision"] : ["projectId", "action"]));
+    const projectId = safeInputIdentifier(input2.projectId, "projectId");
+    const owner = this.#owners.get(projectId);
+    if (!owner || this.#projects.get(projectId)?.role === "viewer")
+      throw new Error("This Project is not writable on this DSH device");
+    if (authorize) {
+      if (typeof input2.enabled !== "boolean" || !owner.authorizeGitHubSync)
+        throw new Error("Invalid GitHub authorization");
+      let expected;
+      if (input2.enabled) {
+        if (typeof input2.repository !== "string" || typeof input2.base_branch !== "string" || typeof input2.revision !== "string" || input2.repository.length > 160 || input2.base_branch.length > 255 || input2.revision.length > 128)
+          throw new Error("Invalid GitHub target");
+        expected = { repository: input2.repository, base_branch: input2.base_branch, revision: input2.revision };
+      }
+      await owner.authorizeGitHubSync(input2.enabled, expected);
+    } else {
+      if (typeof input2.action !== "string" || !GITHUB_CODE_ACTIONS.includes(input2.action) || !owner.executeGitHubSync)
+        throw new Error("Invalid GitHub action");
+      await owner.executeGitHubSync(input2.action);
+    }
+    return this.publicState();
+  }
+  async connectGitHub(inputValue) {
+    this.#assertAvailable();
+    const input2 = exactInput(inputValue, /* @__PURE__ */ new Set(["projectId"]));
+    const projectId = safeInputIdentifier(input2.projectId, "projectId");
+    if (!this.#owners.has(projectId) || this.#projects.get(projectId)?.role === "viewer") {
+      throw new Error("This Project is not writable on this DSH device");
+    }
+    await connectGitHubAccount();
+    return this.publicState();
+  }
   dispose() {
     this.#disposePromise ??= (async () => {
       this.#disposed = true;
@@ -27192,7 +28091,7 @@ async function apply(context, rawConfig) {
     workspacePath: config2.workspacePath,
     ...dshHome === void 0 ? {} : {
       dshHome,
-      projectWorkspaceHomeDirectory: path9.dirname(dshHome)
+      projectWorkspaceHomeDirectory: path10.dirname(dshHome)
     },
     ...config2.officialServerUrl === void 0 ? {} : { officialServerUrl: config2.officialServerUrl }
   });
@@ -27250,6 +28149,12 @@ function registerNativeDshRpc(contextValue, controller) {
           return rpcSuccess(await controller.codeSyncAction(payload, true));
         case "code/action":
           return rpcSuccess(await controller.codeSyncAction(payload));
+        case "github/authorize":
+          return rpcSuccess(await controller.githubSyncAction(payload, true));
+        case "github/action":
+          return rpcSuccess(await controller.githubSyncAction(payload));
+        case "github/connect":
+          return rpcSuccess(await controller.connectGitHub(payload));
         default:
           return rpcFailure("gatherthread/not-found", "GatherThread DSH action is unavailable");
       }
@@ -27344,8 +28249,8 @@ async function createProductionOwner(options) {
     throw error62;
   }
   const codeSync = new DshCodeSyncController({
-    permissionPath: path9.join(config2.stateRoot, `code-consent-${createHash8("sha256").update(actor.id).digest("hex")}.json`),
-    binding: createHash8("sha256").update(JSON.stringify([
+    permissionPath: path10.join(config2.stateRoot, `code-consent-${createHash10("sha256").update(actor.id).digest("hex")}.json`),
+    binding: createHash10("sha256").update(JSON.stringify([
       config2.apiUrl,
       config2.projectId,
       actor.id,
@@ -27360,7 +28265,7 @@ async function createProductionOwner(options) {
       // A custom DSH home is an isolated profile, including its code-sync state.
       // Default profiles keep the harness-neutral state shared with Codex.
       ...options.dshHome === void 0 ? {} : {
-        stateRoot: path9.join(options.dshHome, "gatherthread-code-sync", createHash8("sha256").update(config2.workspacePath).digest("hex"))
+        stateRoot: path10.join(options.dshHome, "gatherthread-code-sync", createHash10("sha256").update(config2.workspacePath).digest("hex"))
       }
     }),
     api: new HttpCollaborationClient({
@@ -27372,8 +28277,77 @@ async function createProductionOwner(options) {
     isBusy: () => nativeWorkspace.isBusy()
   });
   await codeSync.start().catch(() => void 0);
+  const githubSync = new DshGitHubCodeSyncController({
+    permissionPath: path10.join(config2.stateRoot, `github-consent-${createHash10("sha256").update(actor.id).digest("hex")}.json`),
+    binding: createHash10("sha256").update(JSON.stringify([
+      "github",
+      config2.apiUrl,
+      config2.projectId,
+      actor.id,
+      config2.workspacePath
+    ])).digest("hex"),
+    readMetadata: async () => {
+      const response = await fetch(`${config2.apiUrl}/projects/${encodeURIComponent(config2.projectId)}/github`, {
+        headers: { authorization: `Bearer ${options.grant.token}` },
+        redirect: "error",
+        signal: AbortSignal.any([ownerAbort.signal, AbortSignal.timeout(15e3)])
+      });
+      if (!response.ok || !response.body)
+        throw Object.assign(new Error("GitHub metadata unavailable"), { code: "code_github_unavailable" });
+      const reader = response.body.getReader();
+      const chunks = [];
+      let size = 0;
+      try {
+        for (; ; ) {
+          const next = await reader.read();
+          if (next.done)
+            break;
+          size += next.value.byteLength;
+          if (size > 16 * 1024)
+            throw new Error("GitHub metadata too large");
+          chunks.push(next.value);
+        }
+      } finally {
+        await reader.cancel().catch(() => void 0);
+      }
+      const envelope = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+      return GitHubProjectStatusSchema.parse(envelope.data);
+    },
+    createEngine: (target) => createGitHubCodeSync({
+      apiUrl: config2.apiUrl,
+      token: options.grant.token,
+      projectId: config2.projectId,
+      actorId: actor.id,
+      workspacePath: config2.workspacePath,
+      repository: target.repository,
+      baseBranch: target.base_branch,
+      revision: target.revision,
+      ...options.dshHome === void 0 ? {} : {
+        stateRoot: path10.join(options.dshHome, "gatherthread-code-sync", createHash10("sha256").update(config2.workspacePath).digest("hex"))
+      }
+    }),
+    api: new HttpCollaborationClient({ baseUrl: config2.apiUrl, bearerToken: options.grant.token, signal: ownerAbort.signal }),
+    runtimes: () => new Map([...codeRuntimes].flatMap(([id, connector]) => connector.stopped || !connector.executionRuntimeId ? [] : [[id, connector.executionRuntimeId]])),
+    isBusy: () => nativeWorkspace.isBusy()
+  });
+  await githubSync.start().catch(() => void 0);
+  let localCodeTail = Promise.resolve();
+  function scheduleCode(operation) {
+    const task = localCodeTail.then(operation);
+    localCodeTail = task.catch(() => void 0);
+    return task;
+  }
+  let codePolling = false;
   const codeTimer = setInterval(() => {
-    void codeSync.poll();
+    if (codePolling)
+      return;
+    codePolling = true;
+    void scheduleCode(async () => {
+      await codeSync.poll();
+      await githubSync.poll();
+    }).catch(() => void 0).finally(() => {
+      codePolling = false;
+    });
   }, 5e3);
   codeTimer.unref();
   let stopPromise;
@@ -27383,14 +28357,19 @@ async function createProductionOwner(options) {
     setLocalAutoUpload: (sessionId, enabled) => manager.setLocalAutoUpload(sessionId, enabled),
     uploadLocalTurns: (sessionId) => manager.uploadLocalTurns(sessionId),
     codeSyncView: () => codeSync.view(),
-    authorizeCodeSync: (enabled) => codeSync.authorize(enabled),
-    executeCodeSync: (action) => codeSync.execute(action),
+    authorizeCodeSync: (enabled) => scheduleCode(() => codeSync.authorize(enabled)),
+    executeCodeSync: (action) => scheduleCode(() => codeSync.execute(action)),
+    githubSyncView: () => githubSync.view(),
+    authorizeGitHubSync: (enabled, expected) => scheduleCode(() => githubSync.authorize(enabled, expected)),
+    executeGitHubSync: (action) => scheduleCode(() => githubSync.execute(action)),
     stop() {
       stopPromise ??= (async () => {
         options.signal.removeEventListener("abort", abortFromRoot);
         clearInterval(codeTimer);
         ownerAbort.abort(new Error("GatherThread native DSH manager stopped"));
+        await localCodeTail;
         await codeSync.stop();
+        await githubSync.stop();
         await manager.stop();
         nativeWorkspace.dispose();
       })();
@@ -27460,6 +28439,7 @@ function createNativeManagedConnector(options) {
       await connector.start();
     },
     updateExecutionProfiles: (profiles) => connector.updateExecutionProfiles(profiles),
+    updateSessionSummary: (session) => connector.updateSessionSummary(session),
     localSyncStatus: () => connector.localSyncStatus(),
     setLocalAutoUpload: (enabled) => connector.setLocalAutoUpload(enabled),
     uploadLocalTurns: () => connector.uploadLocalTurns(),
@@ -27486,7 +28466,7 @@ async function resolveNativeProjectWorkspace(grant, binding, signal, homeDirecto
 }
 function nativeDshHomeFromEnvironment() {
   const value = process.env.DSH_HOME?.trim();
-  return value ? path9.resolve(value) : void 0;
+  return value ? path10.resolve(value) : void 0;
 }
 async function listNativeLlmCatalog(contextValue, signal) {
   const llm = requireLlm(contextValue);